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FULL COMMITTEE HEARING ON 
SARBANES-OXLEY SECTION 404: 
NEW EVIDENCE ON THE COSTS 
FOR SMALL BUSINESSES 


Wednesday, December 12, 2007 

Committee on Small Business, 

Washington, DC. 

The Committee met, pursuant to call, at 10:00 a.m., in Room 
2360 Rayburn House Office Building, Hon. Nydia Velazquez [chair- 
woman of the Committee] presiding. 

Present: Representatives Velazquez, Gonzalez, Cuellar, Altmire, 
Clarke, Sestak, Hirono, Chabot, Akin, Westmoreland, Davis, Fallin, 
and Buchanan. 

OPENING STATEMENT OF CHAIRWOMAN VELAZQUEZ 

Chairwoman Velazquez. Good morning. I call this hearing to 
order. 

This morning the Committee will continue its oversight of the 
implementation of Section 404 of the Sarbanes-Oxley Act. With 
businesses beginning the process of meeting these requirements, 
now it is an appropriate time to reevaluate the burden associated 
with compliance. 

Since its inception, SOX 404 has presented a unique challenge 
for small firms. While they saw the importance of its core goals, 
many could not afford the high expenses associated with compli- 
ance. In fact, the cost of implementing it has caused many entre- 
preneurs to reconsider whether the benefit of being a public com- 
pany is worth it at all. The rise of foreign stock exchanges in so- 
called Sarbanes-Oxley free zones has started to turn what many 
considered a myth into reality. Section 404, as currently config- 
ured, may be undermining the competitiveness of American compa- 
nies. 

I am glad that the SEC recognizes that SOX 404 is a substantial 
burden for small firms. Chairman Cox is to be commended for soon 
undertaking an intensive analysis of compliance data and pro- 
posing an extension of the compliance date for Section 404(b). This 
will allow all interested parties to better understand the impact 
that this regulation will have before it is mandated. 

The recent study by the U.S. Chamber of Commerce, along with 
the American Bankers Association, the American Stock Exchange, 
and the Institute of Management Accountants, has provided a 
foundation for the SEC’s subsequent work. The Chamber’s survey 
was designed to collect data directly from small companies about 

( 1 ) 
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the actual and expected costs related to meeting the requirements 
of Section 404. 

This constitutes the first and only data concerning SOX 404 costs 
that has been released since July when the SEC approved a revised 
auditing standard. When the Committee last examined this issue 
in June, we did not have meaningful data with respect to compli- 
ance costs. The lack of this information limited the Committee’s 
ability to fully assess the deadlines that the SEC has established 
for small firms. 

The survey data confirms what many have suspected — that the 
costs are, in fact, significant, and small companies are already in- 
curring steep expenses. More than half of respondents indicated 
that they will spend more than 3 percent of net income imple- 
menting the requirements of Section 404(a) alone. And many small 
firms are beginning to prepare for 404(b), even though it is more 
than a year away. Sixty-six percent of survey respondents have al- 
ready engaged an auditor as they prepare to comply with this re- 
quirement. 

The survey data highlights that a postponement, if it is to pro- 
vide meaningful relief for small firms, must be issued as soon as 
possible. It is my hope that the SEC will act on the proposed delay 
immediately. Doing so will allow the Commission the time it needs 
to gather meaningful data before small firms are forced to comply 
with the untested revised rules. 

With Chairman Cox’s proposal today, our attention now turns to 
ensuring that the agency’s collection and analysis is accurate and 
thorough. This assessment is key in ensuring that SOX 404 regula- 
tions are right-sized and do not unnecessarily burden small compa- 
nies. I look forward to working with the SEC on this evaluation. 

SOX 404, like so many regulations, is very burdensome and ex- 
pensive for small companies. The SEC — and all federal agencies for 
that matter — must do more to ensure that we do the up front anal- 
ysis to limit the impact on such a key segment of our economy. 

That is why this Committee will soon be considering legislation 
to expand and strengthen the Regulatory Flexibility Act — a key 
tool that gives small firms a voice in the rulemaking process. By 
doing so, we will be better able to preserve the entrepreneurial en- 
vironment that has made the United States a global leader in so 
many industries. 

I would like to thank in advance Chairman Cox and all of the 
witnesses for their testimony today. And I now recognize Mr. 
Chabot for his opening statement. 

OPENING STATEMENT OF MR. CHABOT 

Mr. Chabot. I want to thank the Chairwoman for holding this 
second hearing on the implementation of Section 404 of the Sar- 
banes-Oxley Act and its impact on small publicly-traded companies. 
And I want to extend a very warm welcome to our former colleague 
from California, Chris Cox, the Chairman of the Securities and Ex- 
change Commission. He was certainly a very valuable member of 
Congress when he was here, one of the top leaders in Congress 
during those years, and he is once again serving his country very 
well in his capacity. So we welcome you here this morning, Mr. 
Chairman. 
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Of particular concern is whether the financial controls and audit 
standards required for compliance with Section 404 imposes undue 
costs on small companies and impedes their ability to raise capital. 
Like the securities laws of the New Deal, Sarbanes-Oxley, or SOX, 
was a response by Congress to a crisis in confidence about the mar- 
ket for publicly-traded securities. 

Unlike the endemic problems that caused the stock market crash 
back in 1929, and resulted in much tougher securities laws, SOX 
was a response to a few spectacular but isolated instances of ex- 
treme corporate greed and criminal behavior on the part of a small 
coterie of corporate executives from companies, including Enron, 
WorldCom, Adelphia, and HealthSouth, for example. 

One of the broad issues that the Committee continues to consider 
is whether SOX, especially Section 404, represents the appropriate 
response to these criminal acts or an overreaction that has unnec- 
essarily burdened small public companies. Today’s hearing will ex- 
amine some recent data developed by the United States Chamber 
of Commerce concerning the cost that small public companies will 
incur to comply with the requirements of SOX. 

I think it is particularly relevant to focus on how the Securities 
and Exchange Commission considered costs in the development of 
its most recent interpretations on SOX compliance. The assessment 
of costs is a key component of an agency’s compliance with the Reg- 
ulatory Flexibility Act, something that the Committee recently as- 
sessed in two separate hearings. 

I raise the issue of compliance with the REA, because a review 
of the Commission’s most recent issuances demonstrates a greater 
need for more accurate cost data to understand the impact that the 
SEC’s rules concerning SOX compliance will have on small public 
companies. I am heartened to read in your testimony that the Com- 
mission, under your leadership, will do a full study of the costs 
faced by small companies. 

This data, then, should be used to perform a regulatory flexibility 
analysis, so the Commission can assess appropriate alternative 
methods for compliance with Section 404(b) of SOX. I look forward 
to hearing from our distinguished group of witnesses on these other 
issues concerning the implementation of SOX. 

And I must mention that I, unfortunately, am going to be called 
to another Committee, the Judiciary Committee. We are working 
on the subprime mortgage crisis that has hit the whole country, 
but four states thus far in particular, one being Ohio, my State, the 
others California, Florida, and Michigan especially. And we have 
reached a manager’s amendment in a bipartisan manner, and so I, 
unfortunately, need to be over there. So I apologize to any of the 
witnesses, and I apologize to you, Mr. Chairman. 

However, we are going to have Dave Davis, who is going to fill 
in here for us, to make sure the Democrats don’t get too out of 
hand here on this Committee. 

[Laughter.] 

No. Just kidding. This is one of the committees that really has 
a very excellent relationship, both between the chair and the rank- 
ing member and the staff and the members of the Committee. So 
this is one that really does work around here and has been respon- 
sible for passing quite a few bills in a bipartisan manner. 
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So I want to, once again, commend the Chairwoman for her hard 
work in this, and I want to thank Mr. Davis for filling in. And if 
he has to go, I believe Mr. Westmoreland is also going to fill in for 
a while. And I will he back just as soon as I possibly can, and I 
yield back. 

Chairwoman Velazquez. For the record, not just some bills, 20 
bills. 

Mr. Chabot. Twenty bills. 

Chairwoman Velazquez. Most productive in the last two dec- 
ades. 

Mr. Chabot. Most productive Committee in Congress, right? 

Chairwoman Velazquez. That is right. 

Mr. Chabot. That is right. 

Chairwoman Velazquez. So now we will proceed with our first 
panel, and I just want to extend the warmest welcome to our 
former colleague. The Honorable Christopher Cox. Mr. Cox is the 
28th Chairman of the Securities and Exchange Commission. He 
was appointed by President Bush on June 2, 2005, and unani- 
mously confirmed by the Senate on July 29, 2005. 

During his tenure at the SEC, Chairman Cox has brought 
ground-breaking cases against a variety of market abuses, includ- 
ing hedge funds, inside trading, stock options backdating, and secu- 
rities scams on the Internet. Prior to joining the Securities and Ex- 
change Commission, Chairman Cox served for 17 years in Congress 
where he held a number of positions of leadership in the United 
States House of Representatives. 

Mr. Cox, welcome. 

STATEMENT OF THE HONORABLE CHRISTOPHER COX, CHAIR- 
MAN, SECURITIES AND EXCHANGE COMMISSION, WASH- 
INGTON, D.C. 

Mr. Cox. Thank you very much. Madam Chairman, and mem- 
bers of the Committee. It is a pleasure to be here to testify on be- 
half of the Securities and Exchange Commission concerning the 
costs and benefits of Sarbanes-Oxley Section 404 for small busi- 
nesses. 

The Commission, just like this Committee, shares an abiding 
concern for America’s smaller public companies. Since Sarbanes- 
Oxley became law in 2002, the Securities and Exchange Commis- 
sion has not applied Section 404 to smaller public companies. In 
addition, we recently issued guidance intended to make the process 
for smaller public companies more economical and more efficient 
for the time when eventually they do come into compliance. 

The Commission’s decision to proceed cautiously in deference to 
smaller public companies and their investors is due in significant 
part to the fact that the cost of regulation, as you all well know, 
falls heaviest on smaller companies, both on a per employee basis 
and as a proportion of revenues. It would be impossible for us at 
the SEC to succeed in our mission if we didn’t focus directly on the 
needs of smaller public companies. For that very reason, the SEC 
has a long history of listening to smaller public companies and as- 
sisting them in their efforts to raise capital. 

Just three weeks ago, we adopted new rules designed to make it 
much simpler and easier for smaller public companies to raise cap- 
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ital. Now any small public company with a public float of up to $75 
million can use these simpler rules, compared to the $25 million 
cap that used to be in place under the old rule. That means an- 
other 1,500 public companies will be able to use our simplified dis- 
closure and reporting. 

We also further simplified the rules themselves. We eliminated 
five forms, and we eliminated 36 separate items that used to com- 
prise Regulation S-B. We have also made it more economical for 
smaller companies to sell restricted securities under Rule 144 by 
reducing the holding period from one year to six months, and by 
eliminating many of the other restrictions. 

And non-affiliates won’t have to file forms at all anymore. That 
change will reduce the number of Form 144s filed with the Securi- 
ties and Exchange Commission by nearly 60 percent. These are all 
ways to cut the cost of capital for smaller public companies and for 
small businesses without sacrificing investor protection. 

We also changed the rules to protect private companies that offer 
stock option plans for their employees. Many small, privately-held 
companies were concerned that they might accidentally be required 
to register as public companies even though they don’t have any 
public shareholders. Our new rule fixes that. 

In taking these steps, we have been responding to several key 
recommendations of the SEC’s Advisory Committee on Smaller 
Public Companies. One of the Advisory Committee’s most impor- 
tant recommendations is the topic that we are focused on this 
morning. Specifically, the Advisory Committee recommended that 
smaller companies should not be made to comply with Section 404’s 
external audit requirement “unless and until there is a framework 
for assessing internal control over financial reporting for such com- 
panies that recognizes their characteristics and needs.” 

With that very recommendation in mind, the Commission de- 
layed Section 404 compliance for smaller public companies and set 
to work on providing guidance for those companies that would rec- 
ognize that their needs are different than those of larger compa- 
nies. During the last few years, the Commission and the Public 
Company Accounting Oversight Board have worked together to 
completely repeal the old, inefficient system of implementing Sec- 
tion 404. 

The SEC published guidance specifically for management, which 
had not been done before, and both we and the PCAOB approved 
a completely new standard for Section 404, AS-5 — that is, top- 
down, risk-based materiality focused and scalable for companies of 
all sizes. 

Our SEC management guidance, intended for the company’s own 
use, will relieve smaller companies from having to rely on the audit 
standard as their de facto rule book. For smaller public companies, 
the guidance will be in place the very first time that they come into 
compliance, so that they can avoid wasteful and unnecessary com- 
pliance efforts that others have had to endure under the old stand- 
ard. 

When eventually smaller public companies do come into full com- 
pliance, as the law requires, the new audit standard will encourage 
the scaling of all audits to reflect each company’s circumstances 
rather than a single checklist for all situations. And to ensure that 
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this is what actually happens, the SEC will conduct a study, as you 
have all mentioned here this morning, of the costs and benefits of 
404 compliance under the new auditing standard and the new 
management guidance. 

Currently, under the direction of the Office of Economic Analysis, 
the SEC staff is preparing to gather and analyze real-world data. 
The study will seek to identify trends and provide a comparison to 
costs under the old standard. The study will also pay special atten- 
tion to those small companies that are complying with Section 404 
for the first time. 

This survey of cost and benefits will have two main parts. First, 
there will be a web-based survey of companies that are subject to 
Section 404; and, second, we will conduct in-depth interviews with 
a subset of companies, including those that are just now beginning 
their 404 compliance. This dual approach will allow us to gather 
data from a large cross-section of companies, while providing more 
detailed information about what drives the costs and where compa- 
nies derive the benefits. 

Because we are intent on using real-world data based on compa- 
nies’ actual experiences, this survey will be taking place in the 
coming months as companies for the first time use the new audit- 
ing standard and the new management guidance. Because we have 
to rely on the actual costs that haven’t been incurred yet, the study 
and analysis of the results can’t be completed before June 2008. 

Under the current schedule, smaller public companies would be 
expected to begin complying with Section 404(b) for fiscal years 
ending after December 15, 2008, so the result is that unless there 
is an additional deferral companies would incur compliance costs 
before the SEC has the benefit of the study and the analysis. As 
a result, I intend to propose to the Commission that we authorize 
a further one-year delay in implementation for small businesses in 
order to base our decision on final implementation of Section 404(b) 
on the best-available cost data. 

Since I last testified before the Committee this summer, the SEC 
and the PCAOB have undertaken comprehensive outreach to help 
the small business community prepare to meet their obligations 
under Section 404(a). This outreach has included a half-dozen fo- 
rums around the country. To make sure that our guidance is useful 
and understandable for smaller companies, we have also published 
a brochure designed specifically for the management of small busi- 
nesses. It explains in plain English how to evaluate internal con- 
trols and how to determine whether they are effective. 

We have spent a lot of time distilling the key principles of our 
management guidance into this easy-to-read brochure, and we hope 
that all companies, large and small, will read it. It is, of course, 
available on the web at www.sec.gov. 

Madam Chairman, it is the SEC’s intention that our new guid- 
ance for management and the PCAOB’s new standard for auditors 
will lower overall compliance costs for companies of all sizes, and 
significantly so compared to the old standard. We expect that com- 
pliance costs under Section 404(a) should come down disproportion- 
ately for small business, because the new SEC guidance that has 
been developed specifically for management will allow each small 
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business to exercise significant judgment in designing an evalua- 
tion that is tailored to its individual circumstances. 

Unlike external audits, management in a small company tends 
to work with its internal controls on a daily basis. They have a 
great deal of knowledge about how their company works, what goes 
on inside, and how the firms operate. The new guidance allows 
management to make use of that knowledge, which should lead to 
a much more efficient assessment process. 

We state clearly in the brochure for small business that under 
normal circumstances they don’t need to hire extra help to do their 
assessment. They certainly don’t need to engage an outside auditor 
for this purpose. The normal company personnel who are respon- 
sible for this work should be able to do it as part of their routine 
duties. The goal of all of these efforts is to implement Section 404 
just as Congress intended — in the most efficient and effective way 
to meet our objectives of investor protection, well functioning finan- 
cial markets, and healthy capital formation for companies of all 
sizes. 

We won’t forget the failures that led to the passage of the Sar- 
banes-Oxley Act in the first place, and we won’t forget that for a 
small business to continue to prosper in America both strong inves- 
tor protection and healthy capital formation must go hand in hand. 

Thank you again for the opportunity to speak on behalf of the 
Commission. I would be happy to answer your questions. 

[The prepared statement of Mr. Cox may be found in the Appen- 
dix on page 38.] 

Chairwoman Velazquez. Thank you, Mr. Chairman. And I am 
very, very encouraged by your announcement this morning. Mr. 
Chairman, during the Committee’s hearing on June 5, you indi- 
cated that you would be willing to consider supporting such a 
delay, if it was warranted. At that time, you also indicated that you 
did not believe that a delay was necessary. You now support a 
delay. What changed your mind? 

Mr. Cox. The schedule really requires that if we are going to use 
cost data that we have at least a one-year delay. Otherwise, what 
will happen is that companies will have to incur costs waiting for 
our decision based on the real-world data, and then we might at 
the eleventh hour tell them, “We are sorry. Never mind. Let us 
wait until we get this right.” 

There is a better way to do it, and that is to take all of the real- 
world data, analyze it, make a decision, and then go forward. 

Chairwoman Velazquez. When do you expect that the SEC will 
vote on your proposed delay? 

Mr. Cox. Madam Chairman, that is an excellent question. I have 
had the opportunity to talk to all of the Commissioners about this, 
so that while there has not been formal Commission action yet, I 
do have an informal sense of Commissioner support for this pro- 
posal. And I hope that reasonably early in 2008 we will be able to 
have an open meeting to do this. 

It is also possible, in fact, I will have to consult with the General 
Counsel and with the Division of Corporation Finance, that as has 
been done in the past this could be done by staff action without 
need of a formal Commission open meeting, in which case we could 
do it even more quickly. 
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Chairwoman Velazquez. So if there are procedural steps that 
accompany this rule change, when do you expect that an SEC deci- 
sion in favor of a potential delay will he finalized, if there are pro- 
cedural steps that need to go with the delay? 

Mr. Cox. Well, you know, but for the fact that we are just now 
entering on the holiday season, and New Year’s Day is less than 
three weeks away, I would say we could do it even this year. But 
I think realistically the earliest we could do this would be during 
the month of Janua^. 

Chairwoman Velazquez. The month of January. 

Mr. Cox. Yes. 

Chairwoman Velazquez. I understand that the SEC will soon 
undertake its own data collection effort with respect to SOX 404. 
And the data the Commission collects will undoubtedly be very 
helpful in determining whether SOX 404 compliance continues to 
be burdensome for small firms. Can you provide details as to what 
companies will be surveyed, when it will begin, and how the data 
will be analyzed? 

Mr. Cox. Yes, I can do so in a general way in this hearing, and 
in a more detailed way between the Committee staff and our staff, 
as you might imagine, because the study is being designed by the 
Office of Economic Analysis. There are some general descriptors I 
can use, but there is also a fair amount of detail that you might 
be more comfortable getting from the experts. 

As I described in my opening statement, there are two main 
parts to the survey. We are trying to be both broadly horizontal 
and also do a deep dive into some companies’ experiences in detail 
to make sure that we are not missing anything. The broad-based 
survey could potentially include virtually every company in this 
category, depending on the level of response to a web-based survey 
and how successful we are in eliciting that response. 

The detailed analysis will be based on the experiences of compa- 
nies that are selected because of their typicality, and because we 
think we can infer the most useful information from their experi- 
ences. 

Chairwoman Velazquez. But let me ask you, my concern is if — 
will small companies and other interested parties will be able to 
contribute their recommendations about how to conduct the most 
effective data collection effort? 

Mr. Cox. Yes. The kind of input that you are talking about into 
the design process is very much a part of what we have in mind. 

Chairwoman Velazquez. Once the data has been collected, 
would you be able to share that data publicly? 

Mr. Cox. I would expect so. I think the entirety of this needs to 
be public in order for the public rulemaking process, public pro- 
gram of the SEC, and public company compliance all to work. 

Chairwoman Velazquez. Mr. Chairman, the SEC’s data collec- 
tion effort will be critically important to small companies, no doubt 
about it. It may provide the evidence that SOX 404, in particular 
Section 404(b), needs to be further revised for small companies. 
What sort of results would the SEC have to see to significantly re- 
vise how 404(b) is implemented? 

Mr. Cox. Well, ultimately, we are constrained by the statute 
itself, and so while there are a great deal of accommodations that 
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can be made in terms of implementation such as have already been 
spelled out in our management guidance, and in the audit stand- 
ard, I think that wholesale change in the way that 404(b) applies 
is a matter not for the SEC but for Congress. 

Chairwoman Velazquez. Thank you. And now I recognize Mr. 
Davis. 

Mr. Davis. Thank you. Madam Chairman, and thank you, Mr. 
Chairman. Thank you for being with us today. We appreciate your 
leadership. 

You mention in your written testimony that you would propose 
a delay in implementation to the small business in order to base 
your decisions on final implementation of Section 404(b). Will that 
decision — will the decision on whether to implement a further 
delay of implementation be based solely on the results of the data 
gathered? 

Mr. Cox. I think that it will be based on the totality of informa- 
tion that we possess, but the only new information will be the re- 
sults of the cost study. 

Mr. Davis. And what type of factors will you be looking at on the 
delay? It looks like it is going to happen, the delay will be put 
forth. But what type of factors will you be looking for? 

Mr. Cox. Oh, I am sorry. I may have misunderstood your ques- 
tion. I thought you were talking about what we might do after we 
got the cost data. But you are asking me about — 

Mr. Davis. What type of factors will go into making that deci- 
sion? 

Mr. Cox. Well, that analysis is actually very simple. It is a ques- 
tion of whether or not we believe that it would be beneficial for in- 
vestors, for issuers, and for the markets to have the benefits of this 
cost study and analysis before we make a final decision. Speaking 
for myself as Chairman, I think that is the better part of wisdom. 
That is the most orderly process. 

Otherwise, we will find ourselves halfway or three-quarters of 
the way down the road of the first year of compliance for smaller 
companies with 404(b) at a time when we then take a look at cost 
data and say, “We did not expect this result. We are going to re- 
verse course.” It would be very disruptive for companies that are 
trying to comply in an orderly way. 

Mr. Davis. Okay. What efforts is the SEC doing to ensure that 
auditors do not take advantage of small business filers? 

Mr. Cox. We have been, and the PCAOB has been, engaged very 
directly with auditing firms of all sizes, but particularly those who 
cater to smaller public companies, to make sure that they under- 
stand when the PCAOB and the SEC repealed AS-2 and sub- 
stituted the new top-down, risk-based materiality-focused, scalable 
AS-5, that we did so with a strong view to gaining efficiencies. 

The costs of Section 404 implementation have got to be out- 
weighed by the benefits. That is what Congress intended. I know 
this from speaking to all of the members, both the House and Sen- 
ate side, who have been so concerned about this. I know this from 
speaking to companies, issues, and investors at our roundtables. 

People want the benefits of Section 404. Nobody is saying we 
shouldn’t get those benefits, but they are trying to make sure that 
there is some correlation between the way the thing is imple- 
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merited and the benefits that the market gets. And so we are going 
to keep all of those factors in mind in making these decisions. 

Mr. Davis. Thank you for your dialogue with those that fall in 
with members of Congress to make sure that we have that open 
debate. You stated that the SEC will monitor the effectiveness of 
public company accounting oversight boards inspections of whether 
audit firms are implementing the new auditing standards. Could 
you explain how this process will work? 

Mr. Cox. Yes. It works in a number of ways. In the most formal 
way, it is a function of the inspection process being carried out first 
by the Public Company Accounting Oversight Board, which is in- 
specting the audit firms for 404 efficiencies, and then by our own 
inspection at the SEC of the PCAOB’s inspection process with a 
view to the same efficiencies. 

So the firms, the auditing firms, who are being inspected by the 
PCAOB are getting the full force and effect of the SEC and PCAOB 
inspection process aimed at efficiency. They know that we are quite 
serious about making sure that AS-5 is implemented as intended. 

Second, the PCAOB and the SEC are routinely engaged with the 
firms in discussions of these issues. Our Office of the Chief Ac- 
countant, for example, on a daily basis discusses these topics with 
the auditing firms. And, thirdly, I and the other Commissioners 
and the staff of the SEC have a number of informal opportunities, 
some of them slightly more formal — for example, at our 
roundtables and others, a part of our interaction through meetings 
and our officers and around the country, as I have described in my 
testimony, to focus attention on these matters. 

But changing the way that people operate is very much what the 
PCAOB and the SEC had in mind by repealing AS-2 and sub- 
stituting AS-5. 

Mr. Davis. You stated earlier this year that Congress never in- 
tended the 404 process to become inflexible, burdensome, and 
wasteful. Do you still hold those views? And what is your response? 

Mr. Cox. I do. And because I was a member of the House Senate 
Conference Committee that wrote Sarbanes-Oxley, and because I 
was there on the floor when we were all speaking about it, I know 
that not a single member from any state got up and said, “I want 
a process that is inefficient, costly, and burdensome, that destroys 
American competitiveness.” Nobody said that. Nobody thinks that 
that is what this law is all about. 

What people wanted was a law that gave investors greater con- 
fidence that the numbers that they were relying on to make their 
financial choices were solid and good, that the pathologies that we 
saw manifested in the cases that Congressman Chabot listed — 
Enron, Worldcom, Adelphia, and so on — that all of those things 
would be dealt with in the most serious fashion by our law enforce- 
ment system, that reliability would be the touch-tone of our finan- 
cial reporting in the United States. That is what this was all about. 
And there is a way to do all of that without crushing the whole en- 
terprise in the process. 

Mr. Davis. One final question. A moment ago you talked about 
collecting data. Once you have that data, what will SEC’s decision 
process be dealing with Sarbanes-Oxley compliance? 
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Mr. Cox. Yes. I apologize for beginning to answer that question 
earlier, because I thought that was your earlier question. At that 
point, we will take the cost data and put it together with the total- 
ity of information that we have acquired through extensive exam- 
ination of 404 implementation over the last several years, and then 
make a decision about what to do next. 

This is the same kind of decision that we have already taken 
with respect to small business on multiple occasions with respect 
to foreign private issuers, with respect to accelerated filers, and 
large accelerated filers in the United States. 

Mr. Davis. Thank you. and thank you. Madam Chairman. I yield 
back. 

Chairwoman Velazquez. Mr. Gonzalez? 

Mr. Gonzalez. Thank you very much. Madam Chairwoman. And 
welcome. Chairman Cox. Good to see you again. And I am glad you 
alluded to the fact that we were all there in 2002 when Sarbanes- 
Oxley was adopted. As a matter of fact, the Chairwoman, you, and 
yours truly were members of the Financial Services Committee 
that probably were the focus of all of the hearings, and it was excit- 
ing times for all of the wrong reasons. 

The witnesses were very, very interesting. Most of those wit- 
nesses are today in prison, and some of those — and most — 

[Laughter.] 

— of the companies are no longer in existence. And I guess, you 
know, and I don’t mean to be flippant about it, but do you recall — 
during all of the hearings that were conducted, and, you know, we 
had Bernie Ebbers there, we had everybody from Enron, we had 
Arthur Andersen, we had everybody there, and it was, like I said, 
exciting times. But do you recall any witnesses that were 
summonsed and testified that represented small business public 
trading companies? 

Mr. Cox. I think the answer to your question is no, and I be- 
lieve — I imagine you don’t recall it either, because that seemed not 
to be the focus at the time — and so we can infer from the answer 
to your question — is that this part of the analysis is a very impor- 
tant auxiliary. 

Mr. Gonzalez. Yes. And I guess I am just making the point that 
that really wasn’t the problem. It wasn’t the small business pub- 
licly-traded companies that created the situation that called for 
Congress to act, which I think was the appropriate thing to do. But 
like in most instances, obviously, you know, we cast a wide net 
many times, and we bring many people into it, but it doesn’t mean 
that we can’t review what we did in 2002 and tweak it, maybe not 
a wholesale revision, and so on. 

I know that former Chairman Oxley was not receptive to the idea 
of visiting Sarbanes-Oxley. That was my understanding a year ago. 
Now we have Chairman Frank. I really don’t know his position and 
how flexible he might be in entertaining maybe some revisions, 
again some tweaking to see if we can make it a little easier in its 
application. 

Still provide the public the safeguards that are really the essence 
of the legislation that were a result of certain misconduct at a cer- 
tain level that truly impacted our economy, investor confidence, 
and so on. I think that is the appropriate thing. 
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And see if I am reading you right in your testimony. There is 
only so much the SEC can do in the implementation to take care 
of the cost, the inconvenience, and of course I think there is dimin- 
ishing return as to the objectives of Sarbanes-Oxley at the end of 
this thing. But, really, it probably is up to the United States Con- 
gress to look at it and to see if anything can be done legislatively. 
Would you agree with that? 

Mr. Cox. Well, I always have a great respect, which I have built 
up over my time serving in this institution, for the role of the legis- 
lative process and the choices that policymakers have before them. 
That is not our job at the SEC. Our job is to make the laws that 
we did pass work in the best way possible. I am of the view, having 
had — going to my third year experience as a regulator looking at 
this, that it should be able to work without legislative change, and 
that is what we are trying to do. 

I say that because while we didn’t have small businesses up at 
those hearings focused on Enron and the rest, we all well know 
that financial fraud exists also in smaller public companies. And, 
in fact, in many cases some of the pathologies are even worse be- 
cause the lack of internal controls in some small companies are 
more egregious than could possibly exist in a larger company with 
more routinized processes. 

So the focus on internal controls is not misplaced. It is something 
that small public companies need just like large public companies. 
But what happened, because we had all of our focus on enormous 
firms, is that the system that was designed to implement it just 
didn’t fit. We once in a while allude to the mythology tale of Pro- 
crustes who used to stretch his victims onto Procrustean beds, so 
that eventually they would fit. That is a little bit of what we saw 
going on with small business and 404 compliance. 

Lastly, I would just say that while there is enormous concern in 
the small business community about the potential effects of SOX 
404(b), the small business sector is the one group that has never 
done it. And there is now a new system in place which we fully in- 
tend will be vastly different than the one that they observed other 
companies having so much trouble with. 

So I think the first opportunity we should take is to get it right, 
the way Congress wrote the law, and only failing that would policy- 
makers have to come in and do something else. 

Mr. Gonzalez. All right. Well, I appreciate your service, and, of 
course, your testimony today. I yield back. 

Chairwoman Velazquez. Time has expired. Ms. Fallin? 

Ms. Fallin. Thank you. Madam Chairman. Appreciate you com- 
ing today and talking about a very important issue to our business 
community and the United States. I had a couple of questions. Are 
you going to survey companies that are private, but might want to 
go public? 

Mr. Cox. It is an excellent question. The cost study that we are 
talking about is literally focused on the costs of complying with the 
new management guidance, and the new audit standard. And so it 
would be impossible to derive that information from companies 
that aren’t complying and are incurring those costs. But survey 
data of companies that are thinking about going public would be 
enormously useful for other purposes. 
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Ms. Fallin. Okay. And once the Commission has collected the 
data, what types of action could it take to reduce Sarbanes-Oxley 
compliance for the smaller companies? 

Mr. Cox. I think we are going to have to stay with this. I have 
thought all along that writing a new audit standard, and writing 
management guidance that is directed to small business and takes 
into account their special concerns, is only half the job. After that, 
you know, starting with user-friendly things, like a brochure for 
small business that explains in plain English what modest steps 
people can take to get started on this, and extending to talking to 
the audit firms and making sure that they are focused on effi- 
ciencies and they are not taking advantage of their clients, all of 
these things are going to require constant vigilance and mainte- 
nance by the SEC. 

Ms. Fallin. Thank you. Madam Chairman. Thank you. 

Chairwoman Velazquez. Ms. Hirono? 

Ms. Hirono. Thank you. Madam Chair. Mr. Cox, I note in your 
testimony that you state clearly in your brochure as to the small 
companies that under normal circumstances they would not need 
to hire an outside auditor to do this assessment as required. Now, 
the reality might be, however, that because there are penalties in- 
volved in not complying, wouldn’t it be the case that for most com- 
panies that they would want to have an outside auditor do this? 

Mr. Cox. I don’t think so. 

Ms. Hirono. An auditor do this assessment? 

Mr. Cox. I think the external audit piece clearly contemplated as 
the 404(b), and what we have been careful to do is parse that for 
small businesses as we phase in their compliance. So at this point 
what smaller public companies are going to be expected to do is 
their own assessment. 

Of course, they all have auditors to do their financial statements, 
and the statute itself, you know, contemplates that this is some- 
thing of an integrated process. So there is no rule against talking 
to your auditor and having a good healthy dialogue at all times and 
asking your question about what they think. 

But the idea that it is the auditor’s job either to design the self- 
assessment or to attest to it as part of this 404(a) process I think 
is very misplaced. And we have been trying to focus everyone on 
that, in the brochure talk about what special expertise companies 
have about this. Companies know how they work best of all. They 
know the risks of their business. They know sometimes at a very 
detailed level what checks might be in place — for example, a clerk 
taking money out of the cash register or whatever are the special 
risks of their business. 

Ms. Hirono. If I could just focus — 

Mr. Cox. Getting an auditor involved in that kind of level of de- 
tail I think is one of the big problems that we had under the old 
standard. 

Ms. Hirono. I understand what you are saying. It is laudable 
that you would want to say to the small companies, “You don’t 
need to go out and spend money and have an outside auditor.” 
However, because of the penalties that would be involved, and you 
also noted that for small companies there may be more concern 
about in-house kinds of assessments and — 
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Mr. Cox. I should just add that the penalties that attach are the 
penalties that have always attached to having something wrong 
with your financial statements. In the phase-in that — as we have 
laid it out for smaller business, the 404(a) process results in a man- 
agement’s assessment that is furnished and not filed with the SEC. 
That means there is no different penalty that attaches. 

The only penalties are the ones that they have always had and 
have right now, and that is for filing financial statements with 
something wrong with them. But nothing different about the inter- 
nal controls assessment. 

Ms. Hirono. Well, that is also reassuring. So your feeling is that 
once you are able to, through a brochure like this, and your efforts 
to meet with the small business community, and to reassure them 
that they do not have to spend all kinds of money to be able to 
comply with 404(b), that in fact the new rules that you have adopt- 
ed will not have such an adverse impact on small business compa- 
nies’ ability to comply. 

Mr. Cox. Yes. In fact, I — 

Ms. Hirono. What is your expectation? 

Mr. Cox. — would go so far as to say that if we get this right, 
ultimately the greater investor confidence that would result from 
this process could reduce the cost of capital for smaller businesses. 
Not to say they won’t have an outlay to do the compliance, but if 
cost of capital is a function of investor conference or concern at 
some level, and appreciation of risk, there is I think a way for — 

Ms. Hirono. I think that is a good point. 

Mr. Cox. — us all to win at this. 

Ms. Hirono. Thank you. Thank you. Madam Chair. 

Chairwoman Velazquez. Mr. Westmoreland? 

Mr. Westmoreland. I don’t really have any questions or com- 
ments. Good to see you again, and appreciate you all taking a good 
look at this. And hopefully you will come up with a decision to 
maybe put it off another year, but I do appreciate your being here 
and coming to testify. 

Chairwoman Velazquez. Okay. Thank you. Mr. Chairman, I 
know you don’t want to stay for the — to listen for the second panel. 
And I would like for you later, before you leave, to identify the staff 
person that will stay here. 

Mr. Cox. Yes. In fact, I think we will have more than one. 

Chairwoman Velazquez. Okay. Great. 

Mr. Cox. But during this morning’s second panel, we will hear 
testimony from senior representatives from small companies. The 
witnesses’ written statements include clear indication of SOX 404 
costs, actual and projected, and I would like to read to you a few 
of the figures they will cite. 

University Security Instruments, a non-accelerated filer, esti- 
mates implementation of SOX 404 as revised will cost the company 
$150,000 to $200,000. Furthermore, they estimate the company will 
incur $100,000 in extra fees each year once their company adopts 
SOX 404. Pendleton Community Bank, a non-accelerated filer, has 
already spent $70,000 to comply with the revised Section 404 and 
estimates that coming into full compliance will cost the company 
a total of $218,000. This is 8.9 percent of anticipated 2007 net in- 
come for the bank. 
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Tandy Leather Factory, a non-accelerated filer preparing for SOX 
404 compliance in 2004, spent $157,000 in fees. This amounted to 
6 percent of the company’s earnings in 2004. Tandy’s auditors indi- 
cated in 2006 that the work Tandy has done in preparation for 
SOX 404 compliance was very basic and preliminary. 

Mr. Chairman, are these costs in line with your and Commis- 
sion’s expectations about reasonable SOX 404 costs for non-acceler- 
ated filers? 

Mr. Cox. Well, I think we are going to be very interested in tak- 
ing a look at what kinds of activity results in these expenses, and 
comparing it to over the broadest possible sample that we can, to 
provide you with a rigorous answer to that question. But that anec- 
dotal evidence is the sort of thing that I am sure animates your 
concerns, because those expenses are much higher than what were 
originally estimated by the Commission when the impending rule 
was adopted and when PCAOB first adopted AS-2, the old stand- 
ard. 

We expect it to be less expensive than that old standard. These 
numbers indicate that that is not so. 

Chairwoman Velazquez. Are there any other members who wish 
to make questions at this point? 

[No response.] 

Mr. Buchanan, we are about to end this first panel. Do you have 
any questions for Mr. Cox? 

Mr. Buchanan. No, thank you. 

Chairwoman Velazquez. Mr. Chairman, I really want to thank 
you for your appearance here this morning, and your willingness 
to listen to small companies. And I want to state for the record that 
I truly personally believe after listening to small companies, and 
holding a hearing not only here in the Small Business Committee 
but also on Financial Services. 

That Section 404(b) is a huge regulation that will redefine how 
small companies access the public market. And I want to state that 
I welcome your reevaluation of this issue, and that I want to thank 
you for the decision that you are making regarding delaying the 
implementation or the compliance of Section 404, because this is 
going to be meaningful to small companies. And not only to small 
companies, but to the auditors and to their investors. 

Nobody wants to see small companies fail because of an inadvert- 
ently burdensome regulation. The delay will also help us — Con- 
gress and the Commission — assess whether the revised rules and 
auditing standards appropriately balance the costs and the benefits 
of SOX 404 for America’s smaller companies. And that is our next 
challenge. 

But before we tackle that one, however, I would like to express 
my personal appreciation to you for your leadership on this issue. 

Mr. Cox. Thank you. Madam Chairman. And you also asked that 
I identify the key staff that are here today to listen to the next 
panel. They include the Deputy Chief Accountant for Audit, Zoe- 
Vonna Palmrose, and the Director of the Office of Small Business 
at the SEC, Gerry Laporte. 

Chairwoman Velazquez. And with that, Mr. Chairman, you are 
excused. 

Mr. Cox. Thank you. 
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Chairwoman Velazquez. May I ask for the second panel to 
please come forward? 

And now we are going to proceed with the second panel. Our first 
witness is Mr. Michael Ryan, Jr. Mr. Ryan is Senior Vice President 
of the U.S. Chamber of Commerce, and Executive Director of the 
Chamber’s Center for Capital Markets Competitiveness. The U.S. 
Chamber of Commerce is the world’s largest business federation 
representing three million organizations of every size, sector, and 
region. 

Welcome, Mr. Ryan, and you will have five minutes to make your 
presentation. 

STATEMENTS OF MICHAEL J. RYAN, JR., U.S. CHAMBER OF 

COMMERCE 

Mr. Ryan. Thank you very much. Good morning. Madam Chair- 
man, and members of the Committee. As the Chairwoman said, my 
name is Michael Ryan. I am Executive Director and Senior Vice 
President of the U.S. Chamber of Commerce’s Center for Capital 
Markets Competitiveness. 

On behalf of the Chamber, and our small business members, I 
want to thank you for holding this hearing and focusing attention 
on this very important issue. On June 5th, this Committee held a 
similar hearing concerning the disproportionate and unnecessary 
burden that immediate application of SOX 404 would have on 
small companies. Since then, the Committee has asked questions 
of and received answers from the SEC concerning its cost-benefit 
analysis in connection with SOX 404 implementation for small pub- 
lic companies. 

More recently, the U.S. Chamber, working with others, released 
the results of a survey conducted to quantify the expected cost to 
small businesses of immediate application of Section 404(a) and the 
application of Section 404(b) beginning a year from now, which is 
the current timeline for these two provisions. 

As I begin my testimony, I would like to make several basic 
points. First, small businesses are critical to the long-term health 
and vibrancy of the U.S. economy. They are the source of millions 
of jobs and the incubator of many of the next generation of innova- 
tive products and services. Second, the U.S. Chamber supports the 
purposes of the Sarbanes-Oxley Act, including the application of 
Section 404 internal control provisions to small companies. 

Third, while the recent changes to Section 404 implementation 
are positive steps forward, these changes are complex and will nec- 
essarily be more costly to implement during the first year than in 
future years. Fourth, almost all regulation disproportionately bur- 
dens small businesses, and this will undoubtedly be the case with 
Section 404, even when we get it right. 

Fifth, a one-year delay for small public companies while the 
kinks are worked out would significantly reduce the dispropor- 
tionate burden. And, finally, to realize the maximum benefit from 
a delay, we need that delay to be announced immediately. Our sur- 
vey shows that companies are already spending money, and each 
day that passes undermines the benefit a delay would provide. 

Since this Committee’s hearing this past summer, new data have 
been collected that sheds light on some small companies’ cost of 
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compliance with 404. On November 8th, we released a study show- 
ing that, despite recent reforms. Section 404 will disproportionately 
burden small businesses. Unless the SEC or Congress takes action, 
the current timeline will require small public companies with a cal- 
endar year end to begin complying with 404(a) in early 2008 and 
404(b) in early 2009. 

While the SEC has predicted that non-accelerated filers would 
not engage their auditors for SOX 404 compliance until the first 
half of 2008, more than 83 percent of the respondents have already 
done so with respect to 404(a) and 58 — more than 58 percent have 
done so with respect to 404(b). The study also shows that more 
than half of the companies responding with less than $75 million 
in market value will spend more than 3 percent on net income — 
of net income on Section 404(a). Sixty-three percent anticipate a 
cost increase in the next year due to compliance with 404(a) and 
(b). Finally, more than 58 percent of the respondents believe that 
404 will not help detect and prevent fraud. 

Our study shows why small companies complying for the first 
time should not be guinea pigs for the improved rules adopted by 
the SEC and the PCAOB. We continue to support strong internal 
controls and believe that the improved rules, if implemented as in- 
tended, will address many of the challenges companies face in com- 
plying with Sarbanes-Oxley. 

We once again applaud the initiatives made by the SEC and the 
PCAOB to fix the implementation process for Section 404 to better 
reflect the intent of Congress and the needs of investors and com- 
panies. We view the PCAOB’s new auditing standard, as well as 
the SEC’s management guidance for companies, as a significant 
step forward. And we commend Chairman Cox and Chairman 
Olson and their respective agencies for their leadership, time, and 
energy to bring balance back to the system. 

In the end, we are hopeful that these changes will restore the 
balance we believe Congress intended all along and will bring costs 
more in line with the benefits. Further, we recognize and strongly 
support the efforts the SEC and the PCAOB have put forth since 
May to ensure that auditors and public companies alike fully un- 
derstand the new rule and guidance and implement them in as cost 
effective a manner as possible. 

These efforts have taken many forms, including hosting town 
hall meetings around the country and issuing detailed guidance. 
We believe, however, that the need for these efforts — and we agree 
they were needed — only goes to support our argument for further 
delay for small businesses. That is, the changes put in place in 
May by the SEC and the PCAOB are complex, not easily under- 
stood, and will require a great deal of time and energy to work out 
the details. 

Therefore, implementation in 2007 and 2008 will necessarily be 
more costly than will be the case in future years when much of the 
transition pain will be behind us. In the meantime, U.S. small 
businesses should not have to shoulder the disproportionate regu- 
latory burden. 

With a further delay for small businesses we will be better able 
to leverage the experiences of large companies, the auditing profes- 
sion, and regulators to ensure that implementation costs are mini- 
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mized. Failure to do so — failure to do this could significantly under- 
mine the cost-cutting objectives of the new standards. 

We also need to remain prepared to make additional changes if 
the new rules don’t work as intended. At least two of the five SEC 
Commissioners, Commissioners Atkins and Casey, have publicly in- 
dicated a willingness to consider such a delay. And based on the 
testimony we heard from Chairman Cox just a few moments ago, 
I would add him to that list. 

The Senate Committee on Small Business and Entrepreneurship, 
led by Chairman Kerry and Ranking Member Snowe, held a hear- 
ing this past April, and these Senators have publicly called for fur- 
ther delay. The Office of Advocacy at the Small Business Adminis- 
tration has also just — has also joined in and asked the SEC to re- 
visit the compliance deadlines. 

And just this past week Representative Spencer Bachus, ranking 
member of the House Financial Services Committee, sent a letter 
to Chairman Cox asking for a one-year delay in implementation of 
404(b). In summary, we believe that we will only know if the ef- 
forts of the SEC and the PCAOB have been successful until after 
we have experience with the implementation. 

Therefore, we are again calling for the immediate announcement 
for a one-year delay for smaller public companies before they must 
comply with Section 404, and we urge this Committee to support 
this call for delay. 

Thank you for the opportunity to be here today. 

[The prepared statement of Mr. Ryan may be found in the Ap- 
pendix on page 43.] 

Chairwoman Velazquez. Thank you, Mr. Ryan. 

Our next witness is Mr. Harvey Grossblatt. He is the CEO of 
Universal Security Instruments based in Owings Mill, Maryland. 
Universal is the manufacturer and distributor of residential fire 
and smoke alarms. Universal has been a public company since 
1973 and was included in Fortune Small Business Magazine’s top 
100 fastest growing small companies in 2006 and 2007. Universal 
Security Instruments is listed on the American Stock Exchange. 

Each one of the witnesses will have five minutes. When the light 
is green, you will start. When the light is yellow, it means that the 
five minutes is about to expire. 

STATEMENT OF HARVEY GROSSBLATT, UNIVERSAL SECURITY 
INSTRUMENTS, INC. ON BEHALF OF AMEX 

Mr. Grossblatt. Madam Chairman and members of the Com- 
mittee, I am Harvey Grossblatt, and I would like to thank you for 
the opportunity to comment on the Sarbanes-Oxley Act, Section 
404, about which I feel quite strongly. 

I will attempt to summarize my written testimony. 

Although I fully agree with the need for the legislation to protect 
our investor confidence in capital markets, it is the method used 
to protect the last six percent of the total market capitalization not 
covered by Section 404 with which I disagree. 

My company has been a public company since 1973, and it is a 
non-accelerated filer. Before I became CEO, I was the CFO, and I 
would prepare our 10(q) in one day and our 10(k) in two to three 
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days. Now, without Section 404, it takes us three days for the prep- 
aration of the 10(q) and almost two weeks to prepare our 10(k). 

Additionally, our auditors and lawyers spend 50 percent more 
time reviewing the documents. 

When Sarbanes-Oxley passed, I did not realize our legal and ac- 
counting fees would increase 50 percent immediately as I mistak- 
enly thought that most of the cost would be 404 and believed small 
companies would eventually be exempt. 

I now realize how wrong I was. The implementation of Section 
404 will cost approximately $200,000, plus an additional $100,000 
covering the 50 percent increase in our legal and audit fees. In a 
small company like mine, the management will have to divert valu- 
able time from growing the business to make sure that we comply 
with these rules, spending considerable money without any return 
on our investment. 

I wish I could have understood how this benefits our share- 
holders. When investors buy stock in small public companies, they 
are buying the management, and I believe they would rather have 
us grow their business instead of spending profits without any re- 
turn. I do not understand how the Congress can expect a small cor- 
poration with 20 employees to have the same accounting and con- 
trol systems that multi-billion dollar companies have. 

I realize that Congress tried to help with the implementation of 
these regulations, but it is still a one size fits all approach without 
regard to the impact of the cost of compliance. 

These costs may be spread over two years, but they do not go 
away. It seems to me the only beneficiaries of these rules will be 
the consultants, lawyers, and auditors and not the shareholders 
whom this law was implemented to protect. 

And before I end, I would like to make two comments on Com- 
missioner Cox’s statement. The first, one question was about Com- 
missioner Cox brought out that most companies could do this them- 
selves. I do not believe this will happen as all public companies 
have an independent audit committee made up of independent di- 
rectors who take fiduciary responsibilities very seriously, and I can- 
not believe anyone will let the company’s management review itself 
without having independent consultants come in. 

Secondly, the more important point, if this Committee could fol- 
low up with Commissioner Cox, the biggest problem with all of 
these new recommendations at PCAOB and the SEC that come out, 
it is not clear enough to the auditors. If I told you how many times 
we have to argue with our auditors and they say, “Well, we do not 
have a clear direction,” so they go from one extreme to the other 
extreme. 

That is the biggest problem that we experience. The management 
side is fine. We understand what we have to do for 404, but we 
need clear guidance for our accountants. 

And I would like to end by thanking you for the opportunity to 
provide my personal experience and input to this important issue, 
and I will be happy to answer any questions you may have. 

[The prepared statement of Mr. Grossblatt may be found in the 
Appendix on page 50.] 

Chairwoman Velazquez. Thank you, Mr. Grossblatt. 
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Our next witness is Mr. Bill Loving. Mr. Loving is CEO of Pen- 
dleton Community Bank based in Franklin, West Virginia. Pen- 
dleton Community Bank serves six counties in West Virginia and 
Virginia. Pendleton Community Bank has four branches, 66 em- 
ployees, 710 registered shareholders. 

Mr. Loving is testifying on behalf of the Independent Community 
Bankers Association. ICBA represents 5,000 community banks of 
all sizes and charter types throughout the United States. 

Welcome, sir. 

STATEMENT OF BILL LOVING, PENDLETON COMMUNITY 

BANK, ON BEHALF OF THE INDEPENDENT COMMUNITY 

BANKERS OF AMERICA 

Mr. Loving. Good morning. My name is Bill Loving, and I am 
the Executive Vice President and Chief Executive Officer of Pen- 
dleton Community Bank in Franklin, West Virginia. 

Chairwoman Velazquez and members of the Committee, I appre- 
ciate the opportunity to testify on behalf of the Independent Com- 
munity Bankers of America, ICBA, concerning Section 404 of the 
Sarbanes-Oxley Act of 2002, or SOX, and the results of the Cham- 
ber of Commerce cost of SOX 404 survey. 

On November 8th, 2007, the Chamber released the results of a 
survey on the projected 2007 and 2008 cost of SOX Section 404 and 
its impact on small businesses. Since approximately 25 percent of 
the respondents were from the financial service industry and many 
were community banks, ICBA believes the survey’s results are a 
good reflection of the costs that publicly held community banks are 
experiencing with Section 404. 

The Chamber survey indicated that over half of the respondents 
expect internal and external costs to implement SOX 404(a) this 
year to exceed $200,000, while 44 percent of the respondents expect 
next year’s implementation cost of 404(b) to also exceed $200,000. 
For non-accelerated filers, this amounted to more than three per- 
cent of net income. These results confirm ICBA’s 2005 SOX 404 
community bank survey which showed that the average community 
bank would be spending more than $200,000, devoting over 2,000 
internal staff hours, and spending approximately three to five per- 
cent of their net income to comply with Section 404. 

I can tell you that as CEO of a community bank that is also a 
non-accelerated SEC filer, the Chamber’s survey accurately reflects 
the disproportionate burden that community banks like mine are 
facing to comply with Section 404. This year we have spent about 
$70,000 to comply with 404, which includes cost associated with 
580 man-hours. While the impact on net income for 2007 is ap- 
proximately three percent, the combined cost to date, if accounted 
for in one calendar year would be $168,640 or 6.88 percent of 
2007’s projected net income. 

Like many publicly held community banks, Pendleton Commu- 
nity Bank is a good example of a small company that should not 
be subject to the reporting requirements of Section 12 of the Secu- 
rities Exchange Act of 1934 and to all of the regulatory burdens of 
SOX. With 710 shareholders, we have considered going private to 
avoid these costs, but considering the small community where our 
bank is located, it would be a significant loss both to our commu- 
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nity and to our bank’s reputation if our bank were to go private 
and repurchase most of its stock or participate in a reverse stock 
split, a process that forces out shareholders below a certain level 
of ownership. 

Now that we have reached the end of 2007 and most non-acceler- 
ated filers have completed their management internal control re- 
ports, ICBA supports Chairwoman Velazquez’s request to the SEC 
to delay the implementation of the auditor attestation require- 
ments required by Section 404(b), which for calendar year filers 
would begin in 2008. The one-year delay would give the SEC and 
the PCAOB an opportunity to evaluate the impact of this new guid- 
ance on accelerated and large accelerated filers and would give 
non-accelerated filers that have no experience with Section 404 ad- 
ditional time to understand and apply AS-5. 

We comment Chairman Cox’s decision today to recommend an- 
other delay in implementation of Section 404(b) for the non-acceler- 
ated filers, an action we applaud and certainly welcome. 

ICBA applauds Chairwoman Velazquez’s effort to obtain hard 
dollar estimates from the SEC on the impact that SOX 404 has on 
smaller public companies. The SEC should have made those esti- 
mates prior to adopting AS-5. However, we are pleased that as a 
result of Chairwoman Velazquez’s efforts SEC Chairman Chris Cox 
has committed the Commission to a data collection program begin- 
ning next year. 

ICBA believes that the SEC and the PCAOB should establish 
benchmarks or goals for AS-5 that are tied to reduction in overall 
404 costs. For instance, SEC and the PCAOB should state that the 
goal of AS-5 is to reduce average internal control costs by a certain 
percentage, say, 20 percent. 

ICBA supports the community banks serving the Communities 
First Act of 2007 by Chairwoman Velazquez, which would relieve 
community banks with assets of less than one billion from the re- 
quirements of 404(b) and raise the threshold under the Exchange 
Act to 1,000 providing relief for hundreds of community banks like 
mine that are struggling. 

We appreciate the opportunity to testify and thank you. 

[The prepared statement of Mr. Loving may be found in the Ap- 
pendix on page 53.] 

Chairwoman Velazquez. Thank you, Mr. Loving. 

Our next witness is Mr. Thomas Brandt. He is the CFO, Tele- 
communication Systems, Inc., based in Annapolis, Maryland. TCS 
provides mission critical wireless technology solutions to carriers, 
public safety, and government customers. Mr. Brandt serves as 
Chairman of AeA’s Sarbanes-Oxley Committee and is testifying on 
behalf of AeA, a trade association representing roughly 2,500 high 
tech companies. 

Welcome, sir. 

STATEMENT OF THOMAS M. BRANDT, JR., 

TELECOMMUNICATION SYSTEMS, INC., ON BEHALF OF AEA 

Mr. Brandt. Thank you. 

The AeA, which is the nation’s largest high tech trade associa- 
tion, appreciates this committee’s efforts relating to Section 404 of 



22 


the Sarbanes-Oxley Act, and we thank you for holding today’s hear- 
ing. 

In addition to serving as the Chairman of AeA’s Sarbanes-Oxley 
Committee, I am the Chief Financial Officer of Telecommunication 
Systems, Inc., or TCS, based in Annapolis, Maryland. 

TCS was bootstrapped by the founder as an 8(a) company and is 
now a 500 employee, $150 million accelerated filer under SOX 404. 
I have served as a corporate financial officer for more than 20 
years and started my career as a Price Waterhouse auditor of pub- 
lic companies, where I worked for 12 years. 

When I learned of today’s hearing, I wanted to testify because I 
am convinced that the application of Section 404 to small public 
companies is bad public policy. Based on my experience as both a 
corporate officer and an auditor and as someone who is completing 
the fourth year of Section 404 compliance, it is clear to me that 
Section 404’s cost far outweighs any benefit to investors in small 
cap companies. 

For TCS the incremental Section 404 compliance cost relative to 
the company’s market cap and float continues to be very high. For 
perspective, the average pretext profitability of our business over 
the last three years averaged around two million dollars a year. 
Annual outside audit fees of more than $600,000 represent a big 
bite out of investors’ hides. 

As inefficient as this regulatory impact has been on companies 
like mine, the adverse impact of ever imposing this burden on non- 
accelerated filers is alarming. Although we appreciate the SEC’s 
and PCAOB’s efforts to address this issue through the issuance of 
new guidance, I believe that its effect will be minor and that the 
SEC Advisory Committee on smaller public companies’ rec- 
ommendations to provide tiered exemptions should be revisited. 

Since TCS’ $135 million market cap is meaningfully comparable 
to the $75 million cutoff between accelerated and non-accelerated 
filers, ours is a good case study of the burden of Section 404 on 
smaller companies. My written testimony contains more detail to 
illustrate how our fees have increased, but briefly, between 1999, 
just before our IPO, and 2003, we experienced a sevenfold increase, 
from about $50,000 a year to $370,000, in recurring audit costs, 
when revenues only doubled. This cost reflects a lot of outside scru- 
tiny for a small company before layering on Section 404. 

In 2004, the first year of SOX compliance, our audit fees more 
than doubled to $770,000. For 2005, when we were supposed to re- 
alize the benefits of a second time through cycle, our fees actually 
increased 13 percent to $871,000. For 2006, our fees were $621,000. 

The PCAOB’s AS-5 and recent related SEC guidance is supposed 
to lower the cost for companies like mine, but for 2007, our Big 
Four audit team told us that we had already taken advantage of 
substantially all the top-down risk-based incremental efficiency 
that AS-5 has reiterated. So we should expect our fees to remain 
around $620,000. 

Over the four-year period, the nature and scope of our company 
operations and financial statements has been sufficiently constant 
to make our numbers a fair small cap example. Based on discus- 
sions with my peers, many other companies have been hit much 
harder. While the number of hours to do the recurring extra audit 
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work since the first years of SOX 404 may have modestly declined, 
the average hourly billing rates for auditors have risen sharply. As 
a former auditor, I am sympathetic that as deep pockets, the Big 
Four firms are compelled to charge more to cover their insurance 
and possible outlays for tort claims, as well as higher salaries and 
partner compensation to attract more people to do Sarbanes-Oxley 
work. 

But that cost burden should not be so disproportionately applied 
to the small companies. For small public companies, which rep- 
resent a very small portion of the capital traded in the U.S. public 
markets, the bar of audit oversight and compliance was already 
high enough before 404 and expensive enough to reasonably protect 
investors from the risks of bad accounting. 

For the people who are bold and successful enough to grow a 
company that’s a candidate to go public, our country’s small cap 
markets have represented a valuable alternative to being forced to 
sell their companies or slow down their growth and risk losing a 
competitive advantage. 

I believe that entrepreneurs like my company’s founder should 
have fewer, not more obstacles to grow a business and that inves- 
tors are already sufficiently informed about the risks involved. 
When they can attract the support of public investors, entre- 
preneurs should have the freedom to pursue their visions rather 
than sell out. 

Excessive, recurring regulatory compliance costs are an unneces- 
sary barrier to investor capital. The SEC Advisory Committee on 
Smaller Public Companies, which included an AeA representative, 
very thoughtfully developed advice as to levels of company size, in- 
cluding some companies larger than the non-accelerated filers, 
which should be exempted from some or all SOX 404 work. 

I believe the recommended tiered relief should be revisited and 
made effective. 

[The prepared statement of Mr. Brandt may be found in the Ap- 
pendix on page 61.] 

Chairwoman Velazquez. Thank you, Mr. Brandt. 

Our next witness is Ms. Shannon Greene. Ms. Greene is Chief 
Einancial Officer and Treasurer of the Tandy Leather Eactory, 
where she has worked since 1996. Based in Eort Worth, Texas, 
Tandy Leather has been the resource for over four generations of 
leather crafters providing quality leather, tools, kits, and teaching 
resources since 1919. 

Ms. Greene was appointed to serve on the board of directors of 
Tandy Leather in January 2001. 

Welcome. 

STATEMENT OF SHANNON L. GREENE, TANDY LEATHER 
FACTORY, INC. 

Ms. Greene. Good morning. Madam Chairman and members of 
the Committee. My name is Shannon Greene, and I am the Chief 
Einancial Officer of Tandy Leather Eactory. We are a non-acceler- 
ated filer. We are headquartered in Eort Worth, Texas. 

I am also a member of the newly formed Corporate Leadership 
Advisory Council, which is the U.S. Chamber’s voice of mid-market 
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businesses. The purpose of my being here today is to provide some 
perspective from a small business trying to maintain our position 
as a legitimate public company in today’s market. 

While I would prefer that we were discussing the potential elimi- 
nation of Section 404, I acknowledge that such a discussion is irrel- 
evant at this time. 

With that said, I applaud the SEC and the PCAOB for recog- 
nizing the need to provide scalable rules and guidance to smaller 
companies like ours as it pertains to Section 404. 

I would like to present several points for consideration. First, I 
believe that most small businesses support the concept of a strong 
internal control system. 

Second, non-accelerated filers who have not had to comply with 
Section 404 yet should not be the testing ground for the revised 
rules and guidance. 

Third, if a delay for non-accelerated filers is being considered, the 
decision to delay needs to be made now, as many companies will 
be engaging their auditors soon for 404(b), if they haven’t done so 
already. 

Fourth, the management teams of small businesses wear many 
hats as they generally do not have the financial resources for large 
staffs. The process required to comply with Section 404 further bur- 
dens the management that is already stretched thin. It is impor- 
tant that their process of compliance with Section 404 be as effi- 
cient and as cost effective as possible. 

Fifth, it has been my experience that investors, whether individ- 
uals or institutions, are not as concerned with a company’s internal 
control system as one might think. Many, if not all, of our investors 
would prefer continued growth in company profits rather than for- 
mal documentation and an assessment of our internal control sys- 
tem. 

I think we all agree that the 404 process as originally imple- 
mented was much more burdensome and costly to all companies 
than Congress intended, and we have already seen that a mere 168 
words, as was the original Section 404, had far reaching, unin- 
tended consequences and implications. 

It is important that we get it right this time, and the best compa- 
nies to make that assessment are those who have already gone 
through the process under the original rules. Small companies in 
their first year of compliance cannot be expected to assess the im- 
provement in the rules as they have no basis for comparison. 

The 404 process needs to be as streamlined as possible for com- 
panies so that management teams can focus primarily on growing 
their business. It would be unfortunate to trade dollars spent on 
jobs or product development for inefficient regulatory compliance. 

Small companies should not be the testing ground for the new 
rules, given that 404 tends to have a disproportionate cost impact 
on smaller companies with the first year being the most expensive. 
I would like to know that the revised regulations are going to work 
before we have to apply them to our small company. 

It is important to emphasize that if a delay is being considered 
for non-accelerated filers, the decision needs to be made very soon. 
Four, oh, four (b) applies to us for 2008. We do not have the luxury 
of waiting until the summer or fall to engage our auditors. As a 



25 


result, announcing a delay then will significant minimize the ben- 
efit of that delay for a company like ours, as we will have already 
incurred sizable costs in the form of additional audit fees during 
the first half of the year. 

We are considered a micro cap in the world of public companies. 
Approximately 35 percent of our outstanding stock is owned by in- 
stitutions. I meet with a number of these institutions, as well as 
individual stockholders either via telephone or in person numerous 
times a year. Many of our stockholders own our stock because they 
believe in the potential of our company and are comfortable that 
the management team knows how to grow the company and, there- 
fore, increase its value. 

In all of my discussions with stockholders, I have yet to be asked 
whether we are or expect to be in compliance with Section 404. 
However, I am frequently asked about how much we have and will 
spend trying to comply and how much of a negative impact it will 
have on our earnings. 

While most investors want to invest in ethical companies, I do 
not get the impression that the internal control system is what 
helps those investors make that determination. It is the people of 
the company. 

Due to the immense regulatory burden on public companies large 
and small, I would suggest that we are discouraging companies 
from participating in public markets because it’s not worth the ef- 
fort. The objective of 404 is to provide meaningful disclosure to in- 
vestors about the effectiveness of the company’s internal control 
system. Said in a different way, investors should be able to rely on 
the information they are getting from a public company. 

Rather than penalizing all companies with increased regulation, 
I think stiffer and swifter penalties for offenders is a more effective 
deterrent and would contribute more to the goal of a reputable pub- 
lic market. I am not minimizing the importance of regulatory com- 
pliance. While I do not always agree in principle with the rules and 
regulations set forth, I can assure you that my company takes this 
very seriously. We choose to operate our business within the rules, 
whether we agree with them or not, and we will comply with the 
rules of 404. I would just like to know that the cost to comply is 
money well spent. 

I appreciate the opportunity to be here today and hope you found 
my thoughts and opinions helpful. In summary, please consider my 
request to delay Section 404 compliance for small companies until 
it has been proven that the rules are achieving the intended re- 
sults. 

Thanks. 

[The prepared statement of Ms. Greene may be found in the Ap- 
pendix on page 67.] 

Chairwoman Velazquez. Thank you, Ms. Greene. 

Mr. Ryan, I would like to address my first question to you. As 
you have heard this morning, the SEC is planning to collect data 
related to SOX 404 compliance costs. From your perspective, what 
are some of the most important data that the Commission must 
collect? 
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Mr. Ryan. Well, I, first of all, would suggest that they stratify 
that data collection. I think it was already suggested by looking at 
the smaller companies that are already complying with the 404 and 
seeing how the transition to the new rules plays out in that first 
year, and in particular, how the auditors respond to that, and also 
try to get a sense from companies and auditors, in particular, 
where the more expensive costs are coming from so that as we drill 
down into this area and try to solve this problem we know exactly 
where to target and address as we go forward. 

Chairwoman Velazquez. Any other witness who would like to 
comment on this question? Yes, Mr. Grossblatt. 

Mr. Grossblatt. Yes. In addition, I think the SEC should con- 
sider the management time and internal corporate resources that 
have to be spent besides the outside cost. 

Mr. Brandt. It is just worth noting that the outside audit fees 
are an obligatory disclosure in the proxy statements of all of us fil- 
ers. So there’s objective information that’s readily collectible for 
that dimension of the compliance cost. 

Chairwoman Velazquez. Mr. Brandt, your company as a larger 
small company has already implemented SOX 404. 

Mr. Brandt. Yes. 

Chairwoman Velazquez. And yet without any self-interest asso- 
ciated with the potential delay in the SEC’s SOX 404 compliance 
deadline, you volunteered to testify this morning. Can you explain 
the reasons why you thought it is so important to provide testi- 
mony on this issue? 

Mr. Brandt. Certainly. Having lived this for four years and hav- 
ing been an auditor before, the marginal benefit of what we’ve been 
paying for has been painfully apparent, and it is nil; it is negative. 

The costs we are incurring at $600,000 for our small company 
are grossly disproportionate to the amount of capital at risk in the 
market that we have had invested in our company, and over the 
last several years working with the AeA and my peers and hearing 
the stories of others who have been through this, the prospect of 
applying this to still smaller companies is hard to accept. 

Chairwoman Velazquez. Ms. Greene, as an accounting profes- 
sional, you recommend a delay in small companies’ compliance 
with SOX 404 so that large companies have the opportunity to im- 
plement and test the new auditing standard before small firms are 
required to comply. 

So you believe a one-year delay in Section 404(b) will allow large 
companies sufficient time to work out any problems? 

Ms. Greene. I think it will certainly help. You know, the small 
business that has not had to comply yet, even though the scaled 
down rules, I think, are going to be helpful for small companies. 
I don’t think that we are a good basis of comparison because we 
have not had to do it yet. 

Will one year be enough? I do not know. It depends on how well 
it goes, how the auditors do. A year is better than nothing, but I 
do not think we will know until we get farther into it whether that 
is adequate or not. 

Chairwoman Velazquez. Mr. Loving, in the past this Committee 
has received testimony that some banks are likely to consider going 
private because of the burdens of SOX 404 compliance. From your 
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perspective, what would it mean for the town to have its commu- 
nity bank go private? 

Mr. Loving. Well, from my perspective, I think you have a rep- 
utation risk to consider if the bank would go private. Obviously 
many of the shareholders are, in fact, customers, and they know 
customers. And so a negative reaction could take place because of 
going private, obviously repurchasing the stock against their will, 
and once that would happen, they would potentially look for other 
options for banking. 

And you know, I am a firm believer that the community bank is 
the life blood of the community, and I think it would be very detri- 
mental to many communities if the community banks go private. 

Chairwoman Velazquez. Mr. Brandt, again, since you have al- 
ready implemented Section 404, do you have recommendations 
about how SEC can best study the impact of SOX on small compa- 
nies? 

Mr. Brandt. Well, as was suggested, the audit fee data that can 
be collected objectively from our proxy filings could be stratified, 
and the correlations between those outside costs and market cap or 
revenue or profitability could produce some useful information. 

Chairwoman Velazquez. Ms. Greene, this morning a lot has 
been made of the date by which a company engages an auditor. 
There seems to be some uncertainty as to what engaging an audi- 
tor means in terms of financial commitment by the company imple- 
menting SOX 404. As the person responsible for her company’s 
SOX 404 implementation, when your company engaged an auditor, 
was your company committing to pay a certain amount in fees? 

Ms. Greene. Auditors have indicated to us that we can expect 
our audit fees to increased by 50 percent when they start their as- 
sessment work. Our fees have already gone up substantially in the 
last year or so, the premise from the auditors being that they are 
trying to cover insurance costs. 

I think we run a very efficient audit. I think our auditors would 
tell you that, but we have seen substantial increase already, and 
we are not even SOX 404, working on that yet. They are telling us 
to expect a minimum of a 50 percent increase when they get ready 
to start their work on the assessment. 

Chairwoman Velazquez. Thank you. 

Yes, Mr. Brandt. 

Mr. Brandt. If I may add, I think there is sometimes a mis- 
understanding between the audit work and the preparation work 
for Sarbanes-Oxley 404 review by outside auditors. Most companies 
even my size in the first time through have hired another outside 
firm, whether it is a Big Four or now there are specialist consulting 
firms that have sprung up for the purpose of helping relatively 
small businesses write up their processes and execute the tests 
that are required under the law, which are all additional costs be- 
fore the outside audit fees are incurred. 

I learned from my AeA peers that many of them spent as much 
on that as they did on their incremental outside audit fee cost. 
Now, that is data that is not captured in proxies, but the term 
“audit” has multiple meanings in the context of this discussion. 
That is one of the reasons I wanted to try to be here, because of 
having been on both sides. 
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Chairwoman Velazquez. Thank you. 

Yes, Mr. Loving. 

Mr. Loving. If I could mirror that, most of all our costs have 
been from hiring a consultant to help us in preparing to comply 
with Section 404, and only to mention that the external audit firm 
that we used for years chose to remove themselves from public 
company work, and so we had to go through the process of filing 
a new audit firm because of 404. 

And so most of the costs will not be outlined explicitly in the fi- 
nancials, but there are costs to comply with 404 before you get to 
compliance with 404(b). 

Chairwoman Velazquez. Thank you. 

Yes, Mr. Grossblatt. 

Mr. Grossblatt. We were told by our auditors if we did use an 
outside firm that the audit fee would be two or three times what 
they will charge to review the independents because it becomes an 
issue about if internal people do it there is an independence issue. 
So you really do not save anything by doing it yourself because 
what you will save on the consultants you will pay twice or three 
times on the audit fee. 

Chairwoman Velazquez. Thank you. 

Mr. Ryan, how important is it that the SEC vote on delaying and 
finalize the announcement of the delays sooner rather than later? 

Mr. Ryan. I think that is critical. I think it is everything. If the 
SEC waits to do their study in I believe Chairman Cox suggested 
it was going to be some time this summer for the results, we real- 
ize many of these companies will have already spent the money, 
made the commitments and, back to the testimony of Mr. 
Grossblatt, management time will have been spent on it, which is 
a very significant cost here. 

So we think that our data shows this, and I think the testimony 
here shows that the companies are getting started sooner rather 
than later, and I think that is particularly true for companies that 
really care about these issues. They are the ones being hurt by a 
delay. So we think that is critical. 

Chairwoman Velazquez. I cannot stress enough to the Chair- 
man how important it is for them to make the announcement as 
early as possible, as early as January. 

Mr. Ryan. My sense is he understood that, too. 

Chairwoman Velazquez. Yes. Okay, and now I recognize Mr. 
Westmoreland. 

Mr. Westmoreland. Thank you. Madam Chairman. 

And since I was not here for opening remarks, I do want to com- 
pliment the Chairwoman on her commitment to small business and 
working to get the Chairman to look at delaying the implementa- 
tion of this for one year. And I certainly support you in that. 

Mr. Loving, is your bank audited by state bank regulators? 

Mr. Loving. Yes, sir. It is a very good question. We are regulated 
by state regulators, FDIC regulators. Plus we have to comply with 
SEC regulations, not to mention internal audit, external audit, IT 
audit, compliance audit. I believe that mentions most of the audits 
that we have to comply with or are regulated by. 
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Mr. Westmoreland. So what you are telling me is that basically 
you already had to jump through a lot of hoops to make sure that 
you were within the laws of the banking industry. Is that not true? 

Mr. Loving. Yes, sir, that is correct. We, as senior officers of the 
institution, have to sign a quarterly call report that we are testing 
that the financial information is correct. That is publicly available 
to anyone that goes to the FDIC Web site. 

So the overlay of 404 is redundance and duplication of effort in 
many cases for community banks, one we cannot eliminate in order 
to comply with 404. 

Mr. Westmoreland. And is it not true that even though commu- 
nity banks are probably hit the hardest on their bottom line, it is 
kind of redundant for any bank that has to go through those same 
audits that you have to go through? 

Mr. Loving. That is correct, sir. 

Mr. Westmoreland. Do you think we will ever pass a law that 
makes people completely honest? 

Mr. Loving. I do not think we will ever pass a law that will 
make people completely honest. I certainly applaud the efforts, but 
I think in the case of 404, the cost is too prohibitive. 

Mr. Westmoreland. Thank you. 

Mr. Brandt, you made a couple of comments about CEO com- 
pensation and officers’ compensation, I guess, about trying to find 
people to serve on some of these committees that look at some of 
these audits. 

You know the Big Three. We had Tyco, Enron, WorldCom that 
did some things that were not correct. Those guys are in prison, 
and as I understand it correctly, these CEOs and people that are 
on these different committees have to sign up and have really put 
a lot on the line for what they may be being paid. Is that true or 
would you say that there is more of a risk now having to sign some 
of these affidavits than there was? 

Mr. Brandt. Well, Section 302 of Sarbanes-Oxley provides for 
some representations that we have to make every time we submit 
financial statements, that are very strong consciousness-raisers if 
an officer did not otherwise take seriously that responsibility. I 
have never shown my wife the words that I am signing to that put 
our assets at risk every time I fulfill that obligation. 

And I think that attitude is pervasive. It is the rare exceptions 
that do not recognize how serious the responsibility is. 

Mr. Westmoreland. Yes, sir, but I mean, you could have been 
put in jail before Sarbanes-Oxley for doing some of the things these 
other people did, right? It is not just signing that 302 that makes 
you liable. There were other laws that would have made you liable, 
too. Is that not true? 

Mr. Brandt. That is absolutely right. 

Mr. Westmoreland. So from what you and Mr. Loving say, Sar- 
banes-Oxley in a lot of ways, not just the 404 but other sections, 
is kind of piling on, so to speak. 

Mr. Brandt. Yes. 

Mr. Westmoreland. Would you agree with that? 

Mr. Brandt. Yes. 

Mr. Westmoreland. I have one question — 

Chairwoman Velazquez. Would the gentleman yield? 
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Mr. Westmoreland. Yes. 

Chairwoman Velazquez. I just would like to say that Mr. 
Grossblatt’s wife is here today. 

[Laughter.] 

Chairwoman Velazquez. And I hope that this hearing is not 
going to be any trouble to you. 

Mr. Grossblatt. I was just trying to give some understanding 
of what we have to put up with on a regular basis. 

Mr. Westmoreland. Hopefully you will not be going off. 

And my last question is for Mr. Grossblatt. So that we will not 
misunderstand anything, you mentioned that your company had an 
extra cost of 200,000 and about another $100,000 increase, I think. 
Who is eventually going to pay that increase that your business 
suffers? 

Mr. Grossblatt. Public shareholders. 

Mr. Westmoreland. Absolutely. Okay. So, I mean, this is some- 
thing that, you know, you just cannot absorb this. I mean, the com- 
pany just cannot absorb this kind of cost, and so Congress, and I 
think the Chairwoman would agree with me, you know, we have 
got a couple of speeds up here, but our main speed is knee-jerk, 
and this was done while some terrible things were done to some 
of the stockholders in some of these companies. 

I was not here, but I have seen the knee-jerk speed, and I think 
it was a knee-jerk and that there really was not enough attention 
paid to the end user in what this was actually going to cost espe- 
cially small business and who was going to be the people actually 
paying for this piling on or double and tripling and quadrupling 
some of these things that we already had laws to cover. 

But, Madam Chairman, that is all I have and thank you so 
much. 

Chairwoman Velazquez. Thanks. 

Mr. Gonzalez. 

Mr. Gonzalez. Thank you very much. Madam Chairwoman. 

As indicated earlier with the Chairman of the SEC, some of us 
were here in 2002 and we were right in the middle of it and voted 
for it. It was an appropriate response, I think, at that time. It was 
referred to as corporate governance. It was quite relevant, and we 
knew there would be some consequences, some intended and others 
not intended. 

Maybe what we are viewing here are the unintended and what 
we are really going to do. But the question really comes down to — 
and I posed this to the Chairman, Mr. Cox, and he indicated that, 
at least the way I interpreted his response was that we probably 
do not need a real legislative fix or tweaking, definitely not a 
wholesale revision of Sarbanes-Oxley, and that much can be done 
within the regulatory scheme and the promulgation of rules and 
guidelines. 

I do not totally agree with that, but I am not on Financial Serv- 
ices. I am not on the other committees, but I am hard pressed to 
believe that universal security instruments in the past created spe- 
cial purpose entities, if you recall what those things used to be, 
based on the advice of the same accounting firm that was con- 
ducting your auditing because they were also doing your con- 
sulting. 
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I do not believe that your enterprise and its officers were exer- 
cising questionable stock option and sales based on insider informa- 
tion. But that is the scenario. That is what we were reacting to. 
And as I said earlier, we cast a very wide net, and maybe it is time 
to review where we are today. 

What was our goal then? What is our goal now, given the history 
and the implementation of the act? 

It is clear and, I think, back in the June hearing and today’s 
hearing, that we really do have to do what businesses do, and that 
is maybe look at a cost-benefit analysis. Are we really getting the 
result that we need or require? 

But it does appear to me that Chairman Cox has expressed a 
clear opinion that corporate governance at all levels is important, 
and I think you heard him actually articulate its application to the 
small publicly traded countries in this country. 

But I really would like to get a feel from where you all are com- 
ing from. We may have a year delay. We may tweak this. My pre- 
diction is we will have the delay; we will have the information 
gathering. The SEC will do everything under its power to make it 
more cost effective and simpler, but we are still going to run into 
the same problem. 

I mean I just really believe that. We do this all the time. We do 
a one-year fix, a two-year fix, and you know, the old thing about 
where I come from we simply say “rnanana." You know, I mean, we 
will just figure it tomorrow. Not good, not good. 

But I’m going to ask Mr. Brandt. You know, you’re talking about 
tiered exemptions. How do you accomplish that? Can you do it 
within regulatory guidelines, the Commission, and so on, or are we 
talking about a legislative fix? 

Mr. Brandt. I started coming to Washington to talk about Sar- 
banes-Oxley 404 when the AeA first invited us here in 2004, and 
I observed sort of what I guess you are saying. We would talk to 
regulators and they would say this has to be dealt with by Con- 
gress, and we would talk to Congress people or their staff and they 
would say this has to be dealt with by regulators. 

It happens that Senator Sarbanes is my Senator, was my Sen- 
ator, and I had an opportunity to address him directly, and he be- 
lieved that this was a regulatory matter insofar as the impact of 
404 on small caps. 

You know, I am here to speak to anybody would will listen that 
I think resources are being misallocated. 

Mr. Gonzalez. So what is the best remedy? How do you see it? 

I mean we are going to have the year delay. We are going to 
have the information gathering. We are going to streamline it, but 
it seems from your testimony you are saying you really are viewing 
something that goes beyond what I anticipate is being con- 
templated, and you are talking about some sort of exemption. 

Mr. Brandt. I am, and without repeating that whole Small Busi- 
ness Committee report, and I did participate along with our other 
representatives in its preparation, there was a lot of thought given 
to the strata in the capital markets where the risk relative to con- 
fidence of outsiders in the integrity of our regulatory process was 
immaterial to anybody rationally reaching that conclusion. 
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So there was a cutoff suggested for self-review and reporting on 
internal control and a lower level where neither self-review nor 
outside auditor review and attestation would be necessary. And I 
believe that was a prudent approach. 

Mr. Gonzalez. And if you did adopt that, could you square that 
with Chairman Cox’s concern regarding small publicly traded com- 
panies and how important it is to have good, solid corporate gov- 
ernance at all levels? 

Mr. Brandt. Yes, I can because I believe there are so many other 
regulations and controls and audit processes to which we are sub- 
ject that the risk of misstatement of financial statements is already 
relatively low. If we make a mistake it might be on applying an 
obscure algorithm like FAS-123(r) for stock option accounting or 
some obscure lease rule, but unless somebody is very willfully try- 
ing to cheat, it is not likely our financial statements are going to 
be bad, and most of us have the self-interest when sign our 302 
statements or just otherwise acknowledge our fiduciary responsibil- 
ities to try to walk the straight and narrow. 

Mr. Gonzalez. Well, thanks. I want to extend my thanks to all 
the witnesses. 

I yield back. 

Chairwoman Velazquez. Ms. Hirono. 

Ms. Hirono. Thank you. Madam Chair. 

The reason I asked Chairman Cox the question about the ex- 
penditures of outside auditors is that in spite of his testimony, I 
did think that probably most of the companies would do that, and 
all of your testimony indicates that that would, in fact, be the case. 

So then the SEC does their study and the study will show that 
most of the companies will be incurring these kinds of additional 
expenses and so they could say, “Well, we are not telling you that 
you should do that. In fact, you should be able to do it with in- 
house personnel.” 

So then we are left and again, I agree with my colleague back 
there that we will be here discussing this again with having prob- 
ably obtained a one-year delay. So I think the bottom line really 
is, Mr. Brandt, what you have brought out and I have a feeling 
what the rest of you probably would like us to address, is a statu- 
tory kind of legislative fix. Is that correct? 

Mr. Loving. Yes, ma’am. I believe that it will take a statutory 
fix to complete the revision of 404 and to improve the profitability 
of small public companies. The new study may show an opportunity 
to reduce cost, but I do not believe that it will be able to reduce 
cost to a point that I can eliminate eight percent or even six per- 
cent of net income to comply with 404. There is going to be a dollar 
specific that we will have to pay to comply with 404 even under 
new ^idance, and someone spoke earlier about the auditors and 
the simplicity or the communication to the auditors. That is the 
second issue. 

It was mentioned we know what it takes to comply, but often- 
times what we are hearing from the auditors is we are not sure 
what the ruling is. So, therefore, you need to do this. 

Well, obviously they are going to err on the side of caution, and 
that usually brings about additional cost. So I do think legislative 
change is necessary. 
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Ms. Hirono. Madam Chair, I would just like to say that I was 
not here when SOX was adopted, but I would certainly be open to 
some kind of a legislative addressing as long as I can refer to what 
Mr. Brandt said, that there are plenty of other checks on what 
companies are doing to make sure that their processes are as they 
should be. 

Thank you. Madam Chair. 

Chairwoman Velazquez. Mr. Westmoreland. 

Mr. Westmoreland. Thank you. 

Just one last question for Mr. Brandt. 

You said you worked for Price Waterhouse for several years. 

Mr. Brandt. I did, 12 years, yes. 

Mr. Westmoreland. Twelve years. These audit firms, the Big 
Four, and you mentioned some of the other ones, were they in- 
volved in the Tyco or Enron or WorldCom, any of the auditing 
firms that are doing your audits now or that do these audits now? 

Mr. Brandt. Well, I understand, of course, it is gone, but pretty 
much every other public company of any size is audited by a Big 
Four firm. 

Mr. Westmoreland. Did SOX put any additional requirements 
on these auditing firms? 

Mr. Brandt. Well, the creation of the PCAOB provided a new 
level of regulation on their profession. So that has become, you 
know, an issue with them, that they are not a self-regulated profes- 
sion any longer, but they have a new entity checking their work 
papers and determining whether they did enough work, which has 
the impact as I think was said earlier that, well, we need to do this 
extra work now because we want to make sure we have enough 
material in our work papers for when the PCAOB looks over our 
shoulders. 

Mr. Westmoreland. So they are auditing the auditors. 

Mr. Brandt. Yes, they are. 

Mr. Westmoreland. Okay. Thank you. 

No further questions. Madam Chairwoman. 

Chairwoman Velazquez. Well, I want to take this opportunity 
again to thank all of the witnesses for taking time from your busy 
schedule and your companies to be here this morning with us. 

And I just would like to issue a note of caution here in the sense 
that I hear some of the witnesses and the members here talking 
about a legislative fix, but this is the United States Congress. It 
is not going to be that easy. So I do not want anyone to be in that 
mindset. 

You know, our hope is and we are happy this morning and grate- 
ful that Chairman Cox is taking the lead in doing right on behalf 
of small companies in this country by doing the cost analysis and 
collecting data in a scientific manner, and I just hope that they do 
this in a very close partnership with those companies that will be 
impacted. 

And with that I ask unanimous consent that members will have 
five days to submit a statement and supporting materials for the 
record. 

Without objection, so ordered. 

This hearing is now adjourned. 
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[Whereupon, at 11:59 a.m., the Committee meeting was ad- 
journed.] 



STATEMENT 
of the 

Honorable Nydia M. Velazquez, Chair 
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Full Committee Hearing Entitled “Satbanes-Oxley Section 404: 
New Evidence on the Costs for Small Companies” 
Wednesday, December 12, 2007 


I call this hearing to order. 

This morning the Committee will continue its oversight of the implementation of Section 404 
of the Sarbanes-Oxley Act. With businesses beginning the process of meeting these 
requirements, now is an appropriate time to reevaluate the burden associated with compliance. 

Since its inception, SOX 404 has presented a unique challenge for small firms. While they 
saw the importance of its core goals, many could not afford the high expenses associated with 
compliance. In fact, the cost of implementing it has caused many entrepreneurs to reconsider 
whether the benefit of being a public company is worth it at all. 

The rise of foreign stock exchanges - in so-called “Sarbanes-Oxley Free Zones” - has started 
to turn what many considered a myth into reality. Section 404 - as currently configured - 
may be undermining the competitiveness of American companies. 

1 am glad that the SEC recognizes that SOX 404 is a substantial burden for small firms. 
Chairman Cox is to be commended for soon undertaking an intensive analysis of compliance 
data and proposing an extension of the compliance date for Section 404(b). This will allow 
all interested parties to better understand the impact that this regulation will have - before it is 
mandated. 

The recent study by the U.S. Chamber of Commerce - along with the American Bankers 
Association, the American Stock Exchange and the Institute of Management Accountants - 
has provided a foundation for the SEC’s subsequent work. The Chamber’s survey was 
designed to collect data directly from small companies about the actual and expected costs 
related to meeting the requirements of Section 404. 

This constitutes the first - and only - data concerning SOX 404 costs that has been released 
since July, when the SEC approved a revised auditing standard. WTien the Committee last 
examined this issue in June, we did not have meaningful data with respect to compliance 
costs. The lack of this information limited this Committee’s ability to fully assess the 
deadlines that the SEC has established for small firms. 
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The survey data confirms what many have suspected - that the costs are in fact significant and 
small companies are already incurring steep expenses. More than half of respondents 
indicated that they will spend more than 3 percent of net income implementing the 
requirements of 404(a) alone. And, many small firms are beginning to prepare for 404(b) - 
even though it is more than a year away. 66 percent of survey respondents have already 
engaged an auditor as they prepare to comply with this requirement. 

The survey data highlights that a postponement, if it is to provide meaningful relief for small 
firms, must be issued as soon as possible. It is my hope that the SEC will act on the proposed 
delay as soon as possible. Doing so would allow the Commission the time it needs to gather 
meaningful data before small firms are forced to comply with the untested revised rules. 

With Chairman Cox’s proposal today, our attention now turns to ensuring that the agency’s 
collection and analysis is accurate and thorough. This assessment is key in ensuring that SOX 
404 regulations are right-sized and do not unnecessarily burden small companies. I look 
forward to working with the SEC on this evaluation. 

SOX 404 - like so many regulations - is very burdensome and expensive for small 
companies. The SEC - and all federal agencies for that matter - must do more to ensure that 
we do the upfront analysis to limit the impact on such a key segment of our economy. 

This is why this Committee will soon be considering legislation to expand and strengthen the 
Regulatory Flexibility Act - a key tool that gives small firms a voice in the rulemaking 
process. By doing so, we will be better able to preserve the entrepreneurial environment that 
has had made the United States a global leader in so many industries. 


- 2 - 
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I U.S. House of Representatives 

SMALL BUSINESS COMMITTEE 

. — 

I Representative Steve Chabot, Republican Leader 

Opening Statement of Ranking Member Steve Chabot 

Sarbanes-Oxley Section 404: New Evidence on the Cost for Small Companies 


“I would like to thank the Chairwoman for bolding this second hearing on the implementation of Section 404 of 
the Sarbanes-Oxley Act and its impact on small publicly traded companies. And I want to extend a warm 
welcome to our former colleague from California, Chris Cox, die Chairman of the Securities and Exchange 
Commission. It is good to see you again, Mr. Chairman. Of particular concern is whether the financial controls 
and audit standards required for compliance with section 404 imposes undue costs on small companies and 
impede their ability to raise capital. 

“Like the securities laws of the New Deal, Sarbanes-Oxley or SOX was a response by Congress to a crisis in 
confidence about the market for publicly traded securities. Unlike the endemic problems that caused the stock 
market crash in 1929 and resulted in much tougher securities laws, SOX was a response to a few spectacular, 
but isolated, instances of extreme corporate greed and criminal behavior on the part of a small coterie of 
corporate executives from companies including Enron, WorldCom, Adelphia, and HealthSouth. One of the 
broad issues that the Committee continues to consider is whether SOX, especially section 404, represents the 
appropriate response to these criminal acts or an overreaction that has unnecessarily burdened small public 
companies. 

“Today’s hearing will examine some recent data developed by the United States Chamber of Commerce 
concerning the cost that small public companies will incur to comply with the requirements of SOX. I think it 
is particularly relevant to focus on how the Securities and Exchange Commission considered costs in the 
development of its most recent interpretations on SOX compliance. The assessment of costs is a key 
component of an agency's compliance with the Regulatory Flexibility Act, something that the Committee 
recently assessed in two hearings. 

“I raise the issue of compliance with the RFA because a review of the Commission's most recent issuances 
demonstrates a greater need for more accurate cost data to understand the impact that the SEC's rules 
concerning SOX compliance will have on small public companies. I am heartened to read in your testimony 
that the Commission, under your leadership, will do a full study of the costs faced by small companies. This 
data then should be used to perform a regulatory flexibility analysis so the Commission can assess appropriate 
alternative methods for compliance with section 404(b) of SOX. I look forward to hearing from our 
distinguished group of witnesses on these and other issues concerning the implementation of SOX. 

“With that, I yield back.” 


### 
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December 12, 2007 

Chairwoman Velazquez, Ranking Member Chabot, and Members of the Committee: 

Thank you for inviting me to testify on behalf of the Securities and Exchange Commission 
concerning the costs and benefits of section 404 of the Sarbanes-Oxley Act for small businesses. 

The Commission and this Committee share an abiding concern for America's smaller public 
companies. Since the Sarbanes-Oxley Act became law in 2002, large public companies have 
come into compliance with section 404 regarding internal controls. But to address concerns 
from smaller public companies, the SEC has not applied section 404 to smaller companies. In 
addition, we recently issued guidance intended to make the process for smaller public companies 
more economical and efficient when eventually they do come into compliance. 

The Commission’s decision to proceed cautiously in deference to smaller public companies and 
their investors is due in significant part to the fact that the cost of regulation falls heaviest on 
smaller companies. As the Members of this Committee well know, smaller firms spend far more 
per employee than larger firms to comply with federal regulations, including those of the SEC. 

It would be impossible to succeed in our mission of promoting capital formation if we did not 
focus directly on the needs of small business. For that reason, the SEC has a long history of 
listening to smaller public companies and assisting them in their efforts to raise capital. For 
more than a quarter century now, we have been sponsoring an annual forum on small business 
capital formation, and I was honored to open the most recent forum just three months ago. Our 
focus in these forums has been on the removal of obstacles that can impede the growth of small 
companies. This responsibility to promote small business capital formation goes hand-in-hand 
with our responsibility to protect investors. 

Just three weeks ago, we adopted new rules designed to make it much simpler and easier for 
smaller companies to raise capital. We expanded the number of companies who can use the 
Commission's scaled disclosure and reporting requirements for smaller companies. Now, 
companies with a public float of up to $75 million can use these simpler rules, compared to the 



39 


$25 million cap that was in place under the old rule. That means another 1 ,500 public companies 
will be eligible to use our simplified disclosure and reporting requirements. 

We also further simplified the rules themselves. We eliminated five forms, and 36 separate 
items that used to make up Regulation S-B. 

We made it more economical for smaller companies to sell restricted securities under Rule 144 
of the Securities Act. We reduced the holding period from one year to six months, and 
eliminated many of the other restrictions on using Rule 144. And non-affiliates won’t have to 
file forms any more - a change we expect will reduce the number of Form 144s filed with the 
Commission by nearly 60%. This is a way to cut the cost of capital for smaller companies 
without sacrificing investor protection. 

We also changed the rules to protect private companies with stock option plans for their 
employees, who have been worried that they might accidentally be required to register as public 
companies, even though they don’t have any public shareholders. 

In taking these steps, we were responding to several key recommendations of the SEC’s 
Advisory Committee on Smaller Public Companies, which issued its final report in April 2006. 
The Advisory Committee focused on ways that the Commission could ensure that the benefits of 
regulation for smaller companies under the federal securities laws outweigh the costs. We greatly 
appreciated the recommendations that we received from the Advisory Committee, and with these 
actions we are continuing to implement them. 

One of the Advisory Committee’s key recommendations was that smaller companies should not 
be made to comply with section 404 of the Sarbanes-Oxley Act, and in particular the requirement 
of external auditor involvement, “[ujnless and until a framework for assessing internal control 
over financial reporting for such companies is developed that recognizes their characteristics and 
needs.” With that very recommendation in mind, the Commission delayed section 404 
compliance for smaller public companies, and set to work on providing guidance for smaller 
public company managements that would recognize that their needs were different than those of 
larger companies. Our experience of the first three years under Sarbanes-Oxley 404 had 
convinced us that the way it was being implemented through Auditing Standard Number 2 was 
too expensive for everyone - and imposing that system on the smallest companies would impose 
unacceptably high costs from the standpoint of the companies’ investors, who would have to pay 
the bills. 

Now, more than five years since the Sarbanes-Oxley Act was signed into law, there are roughly 
5,000 firms in the smaller public companies category that still aren’t required to provide an 
auditor’s report on their internal controls, as required by section 404(b). Generally, this is every 
public company with securities registered with the Commission, if it has less than $75 million in 
public equity. We call them “non-accelerated filers” because larger public companies are 
required to file their annual and quarterly reports with us on a comparatively accelerated basis. 

During the last few years, the Commission and the Public Company Accounting Oversight Board 
(PCAOB) have worked together to specifically address the unique concerns of small business in 
the “non-accelerated filer” category. We completely repealed the old inefficient system of 
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implementing section 404. The SEC published guidance specifically for management, not 
auditors, which had never been done since the passage of SOX. Both we and the PCAOB 
approved a completely new standard for auditors - Auditing Standard Number 5 - that is top- 
down, risk-based, materiality-focused, and scalable for companies of all sizes. And we will 
undertake a serious cost-benefit study of the costs of 404 compliance under the new management 
guidance and auditing standard, to reliably estimate the costs to small business. 

Our SEC management guidance intended for the company’s own use will relieve smaller 
companies from having to rely on the audit standard as their de facto rulebook. It encourages 
cost-effective compliance. It is designed to eliminate unnecessary make-work that does little to 
further the goal of providing reliable financial statements to investors. 

For smaller public companies, the guidance will be in place the very first time they come into 
compliance, so that they can avoid wasteful and unnecessary compliance efforts that others have 
had to endure under the old standard. And the guidance was specifically written with smaller 
companies’ unique control systems in mind. It encourages management to tailor their 
documentation and evaluation approaches to their particular business. This is meant to put an 
end to the one-size-fits-all, check-list approach that many larger companies have bristled under 
as they tried to comply with 404 under the old standard. 

When, eventually, smaller public companies do come into full compliance, the new audit 
standard will encourage the scaling of all audits to reflect each company’s circumstances rather 
than a single check-list for all situations. 

And to ensure that this is what actually happens, the SEC will conduct a study of the costs and 
benefits of 404 compliance under the new auditing standard and management guidance. 
Currently, under the direction of the Office of Economic Analysis, the SEC staff is preparing to 
gather and analyze real-world data. The study will seek to identify trends and provide a 
comparison to costs under the old auditing standard. The study will also pay special attention to 
those small companies that are complying with section 404 for the first time. 

This survey of costs and benefits is expected to have two main parts - a web-based survey of 
companies that are subject to section 404, and i'n-depth interviews with a subset of companies 
including those that are just now becoming compliant. This dual approach will allow us to 
gather data from a large cross section of companies, while providing more detailed information 
about what drives the costs and where companies derive the benefits, especially for newly 
compliant companies. Because we are intent on using real data based on companies’ actual 
experiences, this survey will be taking place in the coming months as companies for the first 
time prepare their financial statements and undergo external audits under the new auditing 
standard and internal assessments with the aid of the new management guidance. 

We anticipate that the study and analysis of the results will be completed no earlier than June 
2008. Under the current schedule, smaller public companies would be expected to begin 
complying with Sarbanes-Oxley section 404(b) for fiscal years ending after December 15, 2008, 
with the result that unless there is an additional deferral, companies will incur compliance costs 
before the SEC has the benefit of the study and analysis. As a result, I intend to propose to the 
Commission that we authorize a further one-year delay in implementation for small businesses in 
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order to base our decision on final implementation of section 404(b) on the best available cost 
data. 

Since 1 last testified before the Committee this summer, the SEC and PCAOB have undertaken 
comprehensive outreach to help the small business community prepare to meet their obligations 
under section 404(a) of Sarbanes-Oxley. This outreach has included a half dozen forums around 
the country. To make sure that our guidance is usefijl and understandable for smaller companies, 
we have also published a brochure designed specifically for management of small businesses that 
explains - in plain English - how to evaluate internal controls and determine whether they are 
effective. We’ve spent a lot of time distilling the key principles of our management guidance 
into this easy-to-read brochure, and we hope that all companies, small and large, will read it. 

Madam Chairman, it is the SEC’s intention that our new guidance for management, and the 
PCAOB’s new standard for auditors, will lower overall compliance costs for companies of all 
sizes, and significantly so, compared to the old standard. We expect the unduly high costs of 
implementing section 404 of the Act under the previous auditing standard will come down for 
those larger companies that will comply with section 404(b) this year. They should come down 
for the very best of reasons: because now, a company and its external auditor will be able to 
focus on the areas that present the greatest risk of material misstatements in the financials - the 
areas that investors truly care about. This is what the law has always intended. 

We expect that compliance costs under section 404(a) should come down disproportionately for 
small business because the new SEC guidance that’s been developed specifically for 
management will allow each small business to exercise significant judgment in designing an 
evaluation that is tailored to its individual circumstances. Unlike external auditors, management 
in a smaller company tends to work with its internal controls on a daily basis. They have a great 
deal of knowledge about how their firms operate. The new guidance allows management to 
make use of that knowledge, which should lead to a much more efficient assessment process. 

We state clearly in our brochure for small business that under normal circumstances they do not 
need to hire extra help to do their assessment. They certainly do not need to engage an outside 
auditor for this purpose, as opposed to auditing their financial statements. The normal company 
personnel who are responsible for this work should be able to do it as a part of their routine 
duties. 

With management now able to scale and tailor their own evaluations, one important step 
remains. The SEC and the PCAOB expect greater efficiencies from the audit firms who are 
responsible for attestation under the new 404(b) procedures. To that end, the PCAOB’s 
inspection program will monitor whether audit firms are implementing the new auditing standard 
in a way that is designed to achieve the intended results. And the SEC, in our oversight capacity, 
will monitor the effectiveness of the PCAOB’s inspections, also with a view to 404 efficiency. 

So both the SEC's and the PCAOB’s inspectors will be focused on whether audit firms are 
achieving the desired efficiencies in the implementation of 404(b) while maintaining the 
effectiveness of the present process. 

The goal of all of these efforts is to implement section 404 just as Congress intended: in the most 
efficient and effective way to meet our objectives of investor protection, well-functioning 
financial markets, and healthy capital formation by companies of all sizes. We won’t forget the 
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failures that led to the passage of the Sarbanes-Oxley Act in the first place. And we won’t forget 
that for small business to continue to prosper in America, both strong investor protection and 
healthy capital formation must go hand in hand. 

The reforms we have made to the SOX 404 process will be of direct benefit to America’s small 
businesses -- and to the millions of Americans who work for them, invest in them, and depend 
upon all that they provide to our economy. We’re re-orienting 404 to focus on what truly matters 
to investors. We’ve wrenched it away from expensive and unproductive make-work procedures 
that waste investors’ money and distract attention from what's genuinely material. And still, we 
intend to be cautious and attentive to real-world cost data before phasing in the final compliance 
requirements for smaller companies. 

Thank you again for the opportunity to speak on behalf of the Commission. I would be happy to 
answer any questions that you may have. 
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Testimony before the House Small Business Committee 
“Sarbanes-Oxley Section 404: New Evidence on the Costs for Small Businesses” 
Testimony by Michael J. Ryan, Jr. 

Executive Director and Senior Vice President, Center for Capital Markets 
Competitiveness, O.S. Chamber of Commerce 

December 12, 2007 


Good morning, Chairwoman Velazquez, Ranking Member Chabot, and members of the 
committee. My name is Michael Ryan and 1 am Executive Director and Senior Vice President of 
the U.S. Chamber Center for Capital Markets Competitiveness (the “CCMC”). The U.S. 

Chamber of Commerce is the world’s largest business federation, representing more than three 
million businesses and organizations of every size, sector, and region. 

Introduction 

Fm here today to discuss the impact of Sarbanes-Oxley (“SOX”) Section 404 on small 
public companies and, on behalf of the U.S. Chamber and our small business members, I would 
like to thank the chairwoman and the committee for holding this hearing and re-focusing 
attention on this very important issue. 

On June 5 of this year, this committee held a similar hearing concerning the 
disproportionate and unnecessary burden that immediate application of SOX 404 would have on 
small companies. Since then, the Committee has asked and received answers from the SEC 
concerning its cost-benefit analysis in connection with SOX 404 implementation for non- 
accelerated filers. More recently, the U.S. Chamber, working with others, released the results of 
a survey conducted to quantify the expected cost to non-accelerated filers of immediate 
application of SOX 404(a) and the application of SOX 404(b) beginning a year from now, which 
is the current timeline for these two provisions. 

As I begin my testimony, I would like to make five basic points: 

First, small businesses are critical to the long-term health and vibrancy of the U.S. 
economy; they are the source of millions of jobs and the incubator of many of the next 
generation of innovative products and services. 

Second, the U.S. Chamber supports the purposes of the Sarbanes Oxley Act, including 
the application of the Section 404 internal control provisions to small companies. 

Third, while the recent changes to Section 404 implementation are positive steps forward, 
these changes are complex and will necessarily be more costly to implement during their first 
year than in future years. 

Fourth, almost all regulation disproportionately burdens small businesses and this will 
undoubtedly be the case with Section 404. 
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And fifth, a one-year delay of Section 404(a) and/or 404(b) while the kinks are worked 
out of the new rule and guidance would significantly reduce this disproportionate burden on 
small public businesses. 

Bacl^ronnd 

On November 8, the U.S. Chamber of Commerce released a study showing that, despite 
recent reforms, SOX Section 404 disproportionately burdens small businesses. 

Unless the SEC or Congress takes action, the current timeline will require non- 
accelerated filers with a calendar year-end to begin complying with SOX 404(a) in early 2008 
and SOX 404(b) in early 2009. While the SEC predicted that non-accelerated filers would not 
engage their auditors for SOX 404 compliance until the first half of 2008, more than 83% of 
respondents have already done so with respect to SOX 404(a) and more than 58% have done so 
with respect to SOX 404(b). 

The study also shows that more than half of the companies responding with less than $75 
million in market value will spend more than 3% of net income on SOX 404(a). Sixty three 
percent anticipate a cost increase in the next year due to compliance with 404(a) and 404(b). 
Finally, more than 58% of the respondents believe that SOX 404 will not help detect and prevent 
fraud. 

Our smdy shows why small companies complying for the first time with SOX 404 should 
not be the guinea pigs for the improved rules adopted by the SEC and the PCAOB. We continue 
to support strong internal controls and believe that the improved rules, if implemented as 
intended, will address the challenges companies face in complying with Sarbanes-Oxley. 

More than 96 percent of the Chamber’s members are small businesses with 100 or fewer 
employees, 70 percent of which have 10 or fewer employees. Yet, virtually all of the nation’s 
largest companies are also active members. Besides representing a cross-section of the 
American business community in terms of number of employees, the Chamber represents a wide 
management spectrum by type of business and location. Each major classification of American 
business - manufacturing, retailing, services, construction, wholesaling, and finance - is 
represented. Furthermore, the Chamber has substantial membership in all 50 states. 

The Chamber has strongly supported many of the reforms in Sarbanes-Oxley, including 
ensuring that boards are more active, independent, and composed of members with significant 
financial and other expertise. In particular, we believe that having effective and independent 
audit committees provides important oversight over the work of internal and external 
accountants. Effective internal controls are an essential part of good financial governance at all 
companies. 

However, the implementation of Section 404 has led to costs and regulatory burdens far 
beyond what Congress intended and well in excess of the benefits to shareholders and 
management. This is amplified among smaller public companies due to economies of scale. 
Companies feel they are getting less effective advice and support from their external auditors, 
and auditors are increasingly being second-guessed by their new regulator and the trial bar. 

The result is predictable: Companies increasingly feel that that the costs of being a public 
company outweigh the benefits, and an important tool companies have used to access capital is 
being eroded. 
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I know access to capital and the capital formation process is of particular interest to this 
committee. Small business drives much of the economic activity, innovation, and job creation in 
the United States. Over the last decade, for example, small businesses have generated 60 to 80 
percent of net new jobs.' These businesses made up 97 percent of exporters and produced 28 
percent of the known export value in FY 2005.^ Small businesses employ 41 percent of high- 
tech workers and produce 13 to 14 times more patents per employee than large patenting 
businesses.^ 

For well over a century, this has been the greatest country on Earth for entrepreneurs and 
innovators to access low-cost capital to start and expand a business. Transparent and liquid 
public markets have been a key part of this. Without these markets, small firms can’t get the 
venture capital or bank loans they need to buy new equipment, hire staff, or develop and market 
their products. Venture capital firms need a clear way get back their investment at a fair 
price. This usually means taking a company public. If the costs of becoming a public company 
are unnecessarily increased, then some companies will not get the venture capital they need, 
resulting in less innovation and competition within the marketplace. Banks also depend on the 
capital markets to securitize the loans they make to small companies, which allows for greater 
lending to small businesses. 

Statistical evidence indicates that regulatory changes resulting from implementation of 
Section 404 of SOX have had a disproportionate impact on the cost of capital for smaller 
businesses that have already had to comply. For example, a $ 1 million to $2 million compliance 
price tag is an enormous burden on a company that has S3 million in net income.'* A study 
released by the GAO in April 2006 stated that public companies with market capitalization of 
$75 million or less paid a median of $1.14 in audit fees for every $100 in revenues. This 
compares to $0. 1 3 in audit fees for public companies with market capitalization greater than $ 1 
billion.^ 

Fortunately, the costs associated with small business capital formation have come to the 
forefront of the agenda for financial markets’ regulators. The SEC and PCAOB have made a 
good-faith attempt at providing scalable rules and guidance to smaller companies. The question 
now is will it be implemented as intended? 

Correcting the Implementation of Section 404 of Sarbanes-Oxley 

The Chamber has been strongly supportive of most provisions of SOX and believes that 
SOX has had positive effects in causing boards, management, and external auditors to be more 
thorough and attentive in fulfilling their responsibilities. Our support for the Sarbanes Oxley Act 
includes the internal control provisions set forth in Section 404. And, we support the application 
of Section 404 to non-accelerated filers. 


' Small Business Administration Web site, htt p:.//appi.sb3.gov/faq.s.ttaqindex.cfm?areaID"24 . 

^ Id. 

^ Id 

** Comment by Clay Corbus, Town Hall Meeting, Commission on the Regulation of U.S. Capital Markets in the 21st 
Century, San Francisco, October 12, 2006. 

^ U.S. Government Accountability Office, Report to the Committee on Small Business and Entrepreneurship, V.S. 
Senate, Sarbanes-Oxley A ct: Consideration of Key Principles Needed in Addressing Implementation for Smaller 
Public Companies, at 17. (April 2006) (GAO Report) available at: fattD:-'Vww'w. gap. gov.tnew. items/d063 6 1 .pdf . 
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The problem has been, as almost everyone agrees, the failed implementation of Section 
404. The 168 words that comprise Section 404, as well as the accompanying Auditing Standard 
2 (“AS2”), have created regulation that produces costs far in excess of benefits, particularly for 
small companies. As Chairman Cox has noted, “Congress never intended that the 404 process 
should become inflexible, burdensome, and wasteful. The objective of Section 404 is to provide 
meaningful disclosure to investors about the effectiveness of a company’s internal controls 
systems, without creating unnecessary compliance burdens or wasting shareholder resources.” 

U.S. Chamber members have frequently expressed concern that the implementation of 
Section 404 has had a negative effect on the competitiveness of U.S. companies and the U.S. 
capital markets, and created burdens on companies and their management well beyond what 
Congress intended. While Section 404 was fundamentally conceived as a disclosure requirement 
to provide more information about internal controls, under AS2 it has evolved into a substantive 
requirement for specific levels of internal controls that goes far beyond the Congressional 
mandate. 

When the SEC and PCAOB issued proposed revisions in December 2006, the Chamber 
voiced a number of concerns (see comment letter available at: http://www.sec.gov/comments/s7- 
24-06/s72406-213.pdfj . Key recommendations included: ensuring a reasonable cost-benefit 
balance; performing a cost-benefit analysis after the rules are adopted; aligning SEC 
management guidance with ASS; clarifying terms such as material weakness, significant 
deficiency, and materiality; clarifying Auditing Standard 3; aligning Auditing Standard 4 with 
ASS; ensuring that the rules are both risk-based and scalable; providing more certainty regarding 
the proposed safe harbor; educating the public about the role and scope of an audit and that a 
restatement does not necessarily indicate a material weakness; allowing for greater use of the 
work of others; providing specific guidance on IT systems and controls; and promulgating 
additional guidance on footnote disclosure controls. The Chamber also raised serious concerns 
about the extent to which the new standards will improve “on the ground” implementation. 

We once again applaud the initiative in May by the Securities and Exchange Commission 
(“SEC”) and the Public Company Accounting Oversight Board (“PCAOB”) to fix the 
implementation process of Section 404 to better reflect the intent of Congress and the needs of 
investors and companies. We view the PCAOB’s new auditing standard as well as the SEC’s 
guidance for companies as a significant step forward and we commend Chairman Cox and 
Chairman Olson for their leadership, time, and energy to bring balance to the system. In the end, 
we are hopeful that these changes will restore the balance we believe Congress had intended all 
along and will bring the costs more in line with the benefits. 

Further, we recognize and strongly support the efforts the SEC and PCAOB have put 
forth since May to ensure that auditors and public companies alike fully understand the new rule 
and guidance and implement them in as cost effective manner as possible. These efforts have 
taken many forms, including hosting town hall meets around the country and issuing detailed 
guidance. We believe, however, that the need for this effort - and we agree that it was needed - 
only goes to support our argument for further delay for non-accelerated filers. That is, the 
changes put in place in May by the SEC and PCAOB are complex, not easily understood and 
will require a great deal of time and energy to work out the details. Therefore, implementation in 
2007 and 2008 will necessarily be more costly than will be the case in future years when the 
transition pain will be behind us and the results of our survey support this. In the meantime, U.S. 
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small businesses should not have to serve as guinea pigs in this process and shoulder a 
disproportionate regulatory burden. 

A Delay for Smaller Companies 

The Chamber has called for a further delay in compliance with Section 404 for smaller 
public companies until the new rules and guidance have been folly tested by larger companies. 
Note that only companies with a market capitalization greater than $75 million have had to 
comply with Section 404 to-date. With a forther delay for smaller businesses, we will be better 
able to leverage the experience of larger companies and the auditing profession to ensure that 
implementation costs are minimized. Failure to do this could significantly undermine the cost- 
cutting objectives of the new standards. We also need to remain prepared to make additional 
changes if the new rules don’t work as intended. 

As it stands today, smaller companies will have to begin complying with the management 
requirements of Section 404(a) in their annual reports for fiscal years ending on or after 
December 15, 2007. They will have to comply with Section 404(b) requiring an auditor’s 
attestation report on internal control over financial reporting in their annual reports starting with 
the first annual report filed for the fiscal year ending on or after December 15, 2008. 

Two of the five SEC Commissioners — Commissioner Atkins and Commissioner Casey — 
have publicly indicated a willingness to reconsider such a delay. The Senate Committee on 
Small Business and Entrepreneurship led by Chairman Kerry and Ranking Member Snowe held 
a hearing on April 18, and the Senators have publicly called for a forther delay. The Office of 
Advocacy of the Small Business Administration has also joined in to ask the SEC to revisit the 
issue of compliance deadlines. And just last week Representative Spencer Bachus, Ranking 
Member of the House Financial Services Committee, sent a letter to Chairman Cox asking for a 
one-year delay in the implementation of Section 404(b). We once again urge this Committee to 
support this call for a reasonable, additional one-year extension for smaller issuers. 

Additional Reforms to Enhance Small Business Competitiveness and Job Creation 

The Chamber believes that SOX has become a catch-all term to refer to a broader set of 
issues facing the public markets and smaller public companies in particular. While Section 404 
is a significant part of the problem, it is not the only part. U.S. companies are facing changing, 
retroactively applied accounting rules that are ever-increasing in complexity. As a result, one in 
10 public companies was forced to restate its earnings last year. This system is not working for 
companies, investors, or auditors. 

America’s securities class action litigation system is broken. It provides inadequate 
compensation to injured parties without deterring future wrongdoers. It fails to protect small, 
undiversified investors, who seldom receive more than pennies on the dollar, while attorneys on 
both sides rake in millions of dollars in fees. Moreover, several recent bipartisan reports have 
highlighted the damage done by the private securities litigation system to U.S. competitiveness 
in the global capital markets and, as a result, to the U.S. economy as a whole. 

We have a regulatory structure filled with duplicative, inefficient, and, in some cases, 
contradictory guidance. Regulators struggle to keep up with the speed and technology changes 
of today’s rapidly changing markets. While no business should be forced to read the minds of 
the regulators, it is particularly difficult for smaller public companies to deal with these issues. 
The system is not working. 
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What Can We Do? 

The challenge is clear and the voices are growing. The Chamber’s independent, 
bipartisan Commission on the Regulation of U.S. Capital Markets in the 21st Century and others, 
including Hal Scott from Harvard, Senator Schumer and Mayor Bloomberg and, most recently, 
the Financial Services Roundtable has echoed that the problems facing our competitiveness are 
real and action is needed. We should remain united in our goal to make the U.S. capital markets 
the most fair, efficient, transparent, and attractive in the world. 

That is why the Chamber formed the Center for Capital Markets Competitiveness in 
March 2007. The Center was established to advance legislative, regulatory, and legal initiatives 
designed to strengthen the competitiveness of U.S. capital markets. 

Granting a further delay for small business in complying with Section 404 would be a 
good step towards addressing these larger issues. But we cannot stop there. We need broad 
litigation and regulatory reform to retain our global capital markets leadership. 

Conclusion 

Chairwoman Velazquez, Ranking Member Chabot, and members of the committee, thank 
you for the opportunity to discuss these serious issues. The Chamber stands ready to work with 
you and others to improve the implementation of SOX 404 — and we congratulate you for taking 
this important step by holding today’s hearing. We also applaud Chairman Cox and Chairman 
Olson for the work they have done. 

In summary, we believe that we will only know if the efforts of the SEC and PCAOB 
have been successful until after we see how they are implemented. Therefore, we are again 
calling for a further delay of one full-year for smaller public companies before they must comply 
with Section 404. Finally, we urge Congress, the SEC, and other regulators to work together to 
address the additional critical issues that are making it increasingly difficult for leaders of 
smaller American companies to access the public capital markets to grow their businesses and 
create jobs. 

Thank you again for the opportunity to be here today. We stand ready to take action on 
behalf of the business community to provide viable solutions that benefit business, workers, 
shareholders and our economy. 
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Madam Chairman and members of the Committee, on behalf of Universal 
Security Instruments. Inc., I would like to thank you for the opportunity to 
comment on the issue related to Sarbanes-Oxley Act Section 404 with regards to 
Non-Accelerated Filers. 

My Company was founded in 1969 and has been a public company since 1973. 1 
believe we were the second company to list on NASDAQ. In July 2003, we 
moved our listing to the American Stock Exchange, which we believed was a 
better exchange for our shareholders. 

When Sarbanes-Oxley was initially implemented, I believe it was needed to 
restore investor confidence in the wave of accounting scandals. The problem 
with the legislation was it did not make any distinctions between very large 
corporations which were seen as the cause of the loss of confidence by 
investors, and small cap companies. I anticipated it would not be required due to 
costs associated with implementing that specific Section for small cap 
companies. Much to my surprise, despite the Advisory Committee 
recommendations. Section 404 was implemented for small cap companies over a 
two year period. 

I thought Congress had realized that small cap companies do not have the 
accounting staff to support Section 404 and consequently provided a delay for 
small cap companies. 
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At first, our annual audit and legal fees increased approximately 50% as a result 
of Sarbanes-Oxley legislation, which cost our shareholders approximately 
$100,000 per year. Once we were advised that, much to our surprise, we were 
required to implement Section 404 this year, my company interviewed 
approximately six consulting firms and received estimates between $150,000 and 
$300,000 for initial compliance and $50,000 to $100,000 for annual testing. 
Additionally, our audit fees will increase approximately $50,000 annually, due to 
the additional testing required. With the implementation of Section 404, my 
company will spend approximately $150,000 to $200,000. Once Section 404 is 
adopted, we are estimating at least $100,000 annually in addition to our 
substantially higher legal and audit fees. From my perspective, I would like to 
discuss the problems that small cap companies experience with Sarbanes-Oxley, 
and particularly Section 404. 

1. We will have spent 3%-4% of our shareholder equity on compliance 
since Sarbanes-Oxley was approved. 

2. We are estimating this year’s earnings will be reduced by at least 5% 
because of Section 404 implementation costs, without getting any 
return on the investment. That translates into a lower stock price, 
which I believe hurts our shareholders. 

3. Since my company made the Fortune Small Business Magazine list in 
2006 and 2007 of the Top 100 Fastest-Growing Small Public 
Companies in the U.S., our shareholder base has changed to 1/3 
institutional. The institutional shareholder does not care about the cost 
of implementing Sarbanes-Oxley and it makes year-over-year 
comparisons more difficult because institutional shareholders may not 
factor in the disproportionate impact of SOX expenses on earnings of 
smaller companies. 

4. Small public companies are generally entrepreneurial, with the 
executives being hands-on and who generally own significant amounts 
of stock. Significant stock ownership by management is a very 
powerful incentive to insure proper financial oversight. As it is, under 
the Section 404 rules, my time is being diverted from trying to grow the 
business to documenting that I have reviewed transactions, trying to 
make sure that we will not have a material weakness and significant 
deficiency. In my opinion, this does not help our shareholders. 

5. My company has been contacted by numerous venture capitalist firms 
to explore the possibility of going private to avoid the costs associated 
with Sarbanes-Oxley. Additionally, we have been sent information 
about listing on the London AIM Exchange. If we would go private, it 
may be beneficial to management, but not our shareholders. We still 
believe our shareholders have the right to participate in our future 
growth. 
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6. It has been difficult for our company to find directors, especially with 
the additional responsibility of various committees as well as finding a 
director who can Chair the Audit Committee. 

Since most small cap companies are run by entrepreneurial management, with a 
significant financial stake in the company, does it make sense that small cap 
companies be required to have the same controls of a Fortune 500 company? In 
my company, management is hands-on and signs every purchase order and 
check. 

In closing, I believe approximately 94% of the equity markets in the United States 
are fully subject to Section 404, leaving 6% not covered by Section 404\ It 
seems to me the primary beneficiaries of Section 404 for small companies are 
the consultants, auditors and lawyers - and not the shareholders the Sarbanes- 
Oxley law was trying to protect. 

Thank you for the opportunity to share my experience with you and to provide 
input on this important issue. I will be happy to answer any questions you may 
have. 


Final Report of the Advisory Committee on Smaller Public Companies to the Securities and Exchange 
Commission, April 23, 2006, page 7. http://www.sec.aov/info/smallbu.s/acspc/acsDC-finalreport.pdf 
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Good morning. My name is Bill Loving and I am Executive Vice President and Chief 
Executive Officer of Pendleton Community Bank in Franklin, West Virginia. 
Chairwoman Velazquez, Ranking Member Chabot, I appreciate the opportunity to testify 
on behalf of the Independent Community Bankers of America (ICBA)‘ concerning 
Section 404 of the Sarbanes-Oxley Act of 2002 (SOX) and the results of the Chamber of 
Commerce Cost of SOX 404 Survey dated November 8, 2007. Section 404(a) requires 
publicly held companies to include an assessment by management of the effectiveness of 
their company’s financial controls and procedures in their annual reports and Section 
404(b) requires the company’s auditor to attest to the effectiveness of the company’s 
internal controls and procedures. 

Summary of Testimony 

• The Chamber Survey, which indicates that this year’s and next year’s costs to 
implement SOX 404 will exceed $200,000 per year confirms the results of 
ICBA’s 2005 SOX 404 Survey of Community Banks and reflects the excessive 
and disproportionate burden that community banks are experiencing with SOX 
404. 

• Like many publicly held community banks, Pendleton Conununity Bank is a good 
example of a small public company that is overburdened with the regulatory 
requirements of SOX 404. 

• ICBA strongly supports Chairwoman Velazquez’s request to the SEC to delay the 
implementation next year of the auditor attestation requirements required by 
Section 404(b) for non-accelerated SEC filers. 

• ICBA applauds Chairwoman Velazquez’s efforts to obtain hard dollar estimates 
from the SEC of the impact that SOX 404 has on smaller public companies. The 
SEC should have made those estimates prior to adopting Auditing Standard No. 5 
or AS-5. 

• To indicate that it is serious about reducing costs, ICBA believes that the SEC and 
the PCAOB should establish quantitative benchmarks or goals for the AS-5 that is 
tied to a reduction in overall SOX 404 audit costs. ICBA still has doubts that AS- 
5 will reduce 404 audit costs, particularly for smaller public companies. 


’ The Independent Communit}’ Bankers of America represents 5,000 community banks of all sizes and charter 
types throughput the United States and is dedicated exclusively to representing the interests of the community 
banking industry and the communities and customers we serve. ICBA aggregates the power of its members to 
provide a voice for community banking interests in Washington, resources to enhance community bank education 
and marketability, and profitability options to help community banks compete in an ever-changing marketplace. 

With nearly 5,000 members, representing more than 18,000 locations nationwide and employing over 268,000 
Americans. ICBA members hold more than $908 billion in assets, $726 billion in deposits, and more than $619 
billion in loans to consumers, small businesses and the agricultural community. For more information, visit 
ICBA 's website at www.icba. org. 
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• ICBA supports the Community Banks Serving their Communities First Act of 
2007 (HR 1869) introduced by Chairwoman Velazquez which would relieve 
community banks with assets of less than $1 billion from the requirements of 
SOX Section 404 and would raise the shareholder threshold from 500 to 1,000 
under the Exchange Act. 

New Evidence from the Chamber of Commerce SOX 404 Survey Reflects SOX 
Burden on Community Banks 

On November 8, 2007, the U.S. Chamber’s Center for Capital Markets Competitiveness 
released the results of its on-line survey on the projected 2007 and 2008 costs of SOX 
Section 404 and its impact on small businesses. Since approximately 25% of the 
respondents to the survey were from the financial services industry and many of these 
respondents were community banks, ICBA believes the survey’s results are a good 
reflection of the costs that publicly held community banks are now experiencing this year 
trying to comply with Section 404(a) and will be experiencing next year as a result of 
complying with Section 404(b). 

The Chamber Survey indicated that over half of the respondents expect internal and 
external costs to implement SOX 404(a) this year to exceed $200,000 while 44% of 
respondents expect next year’s implementation costs of 404(b) to also exceed $200,000. 
For non-accelerated filers that responded to the Chamber Survey, this amounted to more 
than 3 percent of net income. These results confirm ICBA’s 2005 SOX 404 community 
bank survey which showed that the average community bank would be spending more 
than $200,000 and devoting over 2,000 internal staff hours to comply with Section 404. 
Since most community banks are “non-accelerated SEC filers” (e.g., those with public 
float or market capitalization of less than $75 million), we believe the Chamber Survey 
accurately reflects the fact that community banks will be spending in a range of about 
3%-5% of their net income on SOX 404 compliance. 

The Chamber Survey also indicated that nine out of ten respondents expect costs will 
“greatly exceed” or “moderately exceed” the benefits of SOX 404 compliance. This was 
also the conclusion of many of the community banks that participated in ICBA’s 2005 
survey— that the costs of Section 404 compliance significantly outweigh any benefits to 
their companies or their internal control processes. Furthermore, time devoted to Section 
404 compliance is diverting management from its duties of running a bank. Coimnunity 
banks, just like other smaller companies, operate on slim profit margins and simply do 
not have the time and resources to comply with Section 404. The Chamber Survey 
quoted one community banker as saying that “while the purpose of SOX is well-intended 
to put in place reliant control structure, compliance for an institution of our size and 
structure (e.g., asset size is $45 million) has created extremely negative earnings 
consequences because there has been little to no consideration for asset size, human or 
dollar resources.” 
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The Chamber Survey Accurately Reflects the Regulatory Burden of SOX 404 on 
Pendleton Community Bank 

I can tell you that as CEO of a community bank that is also a non-accelerated, SEC filer, 
the Chamber Survey accurately reflects the disproportionate burden that community 
banks like mine are facing to comply with Section 404. This year, Pendleton Community 
Bank and its holding company, Allegheny Bancshares, Inc., have spent about $70,000 to 
comply with Section 404 that includes costs associated with 580 man hours. While the 
impact on net income for 2007 is approximately 3.0%, the combined costs incurred to 
date would, if accounted for in one calendar year, be $168,640 or 6.88% of 2007’ s 
projected net income. This total cost includes $82,987 on vendor and accounting 
expense, $3,500 on training and education expense, 1,380 man hours, and substantial 
board and committee fees. We anticipate costs next year to approximate $50,850 to 
insure compliance with Section 404, resulting in total costs of around $218,310 or 8.95% 
of anticipated 2007 net income for our holding company. These costs do not reflect the 
time and money associated with the selection and appointment of a new external audit 
firm — a consequence of Section 404 since our old firm ceased auditing publicly held 
companies because of the liability and regulatory requirements of SOX 404. Just as the 
majority of respondents indicated in the Chamber Survey, we have already been 
conferring with our outside accountant on our internal control audit for next year. 

Like many publicly held coimnunity banks, Pendleton Community Bank is a good 
example of a small public company that should not be subject to the reporting 
requirements of Section 12 of the Securities Exchange Act of 1934 and to all the 
regulatory burdens of SOX. Our holding company has 710 registered shareholders the 
majority of which reside in or are related to residents of Pendleton County. With 66 
employees and four branches, it is a severe strain for our bank and holding company to 
comply with all the reporting and disclosure requirements of the Exchange Act. 

Our bank has considered going private to avoid these costs. However, considering the 
small community where our bank is located — Franklin, West Virginia has a population of 
less than 1,000 and Pendleton County’s population, based on 2006 estimates, is only 
7,679 — it would be a significant loss both to our community and to the bank’s reputation 
if our bank were to go private and repurchase most of its stock or participate in a reverse 
stock split — a process that forces out shareholders below a certain level of ownership. 
Many of our local residents, who have taken pride in their ownership of the bank, would 
cease to own a share of stock in one of the few publicly held companies in the county. 

Not only would this be costly to our bank, it would be a devastating blow to the 
reputation and image of the community and to many of the stockholders/customers of the 
bank who have supported the bank since its establishment. 
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ICBA Supports Chairwoman’s Velazquez’s Call to Delay Implementation of Section 
404(b) 

ICBA was disappointed that the SEC did not adopt ICBA’s recommendation to delay by 
one year the Section 404 due dates for non-accelerated filers so that calendar year filers 
would have until the due date for their 2008 annual report rather than the due date of their 
2007 annual report to file their management internal control reports. Now that we have 
reached the end of 2007 and most non-accelerated fliers have completed their 
management Internal control reports, ICBA strongly supports Chairwoman 
Velazquez’s request to the SEC to delay the implementation of the auditor 
attestation requirements required by Section 404(b), which for calendar year fliers 
would begin in 2008. The one-year delay would accomplish several things. 

First, since the SEC and the Public Company Accounting Oversight Board or the PCAOB 
have just adopted a new auditing standard under Section 404 (e.g., Auditing Standard No. 
5 or AS-5) and new guidance for management reporting of internal controls, it would 
give the SEC and the PCAOB an opportunity to evaluate the impact of this new guidance 
on accelerated and large accelerated filers. If, for instance, the SEC Guidance and AS-5 
have little impact on SOX 404 audit costs during 2007 or 2008, then the SEC and the 
PCAOB would have time to revise the guidance and the new auditing standard before it 
is fully implemented by non-accelerated filers. 

Second, a one-year delay would also have given non-accelerated filers that have no 
experience with Section 404 additional time to understand and apply AS-5 and the new 
guidance and establish a new internal control framework. As it stands, non-accelerated 
filers will have a very limited time to work with their auditing firms in preparing internal 
control documentation under the new standard. Furthermore, it would enable small 
auditing firms that have yet to perform a Section 404 audit an additional year to analyze 
the PCAOB’s October 17* guidance to auditors in performing audits of smaller, less 
complex companies and participate in PCAOB-sponsored small-business auditing 
forums. We note that 79% of the respondents to the Chamber Survey felt that a delay in 
the compliance deadline for SOX 404(a) and 404(b) would be helpful to their company. 

The SEC Should Track Cost Data on the Impact of Section 404 on Smaller Public 
Companies and Should have Benchmarks for AS-5 

ICBA also applauds Chairwoman Velazquez’s efforts to obtain hard dollar 
estimates from the SEC of the impact that SOX 404 has on smaller public 
companies. The SEC should have made those estimates prior to adopting AS-5. So far, 
the SEC has not produced any specific quantifiable data to support their prediction that 
audit costs will go down as a result of adopting AS-5. However, as a result of 
Chairwoman Velazquez’s efforts, SEC Chairman Christopher Cox has committed the 
Commission to data collection program beginning after the non-accelerated filers first file 
their Section 404(a) management reports either in their proxy statements or their aimual 
reports of Form 10-Ks for 2008. According to Chairman Cox, this data will be collected 
and analyzed by the Commission’s Office of Economic Analysis with the assistance from 
the Office of Small Business Policy in the Division of Corporation Finance and the 
Commission’s Office of the Chief Accountant. 
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ICB A hopes that the Section 404(a) cost data will be available by the spring of 2008 and 
that the SEC will compare the cost data from the non-accelerated filers with the data from 
the accelerated and large accelerated filers. ICBA believes that the SEC and the 
PCAOB should establish quantitative benchmarks or goals for the AS-5 that is tied 
to a reduction in overall SOX 404 audit costs. For instance, the SEC and the PCAOB 
should state that the goal of AS-5 is to reduce average internal control audit costs by a 
certain percentage — say 20%, with a commitment that if the revised standard does not 
meet that goal, then the standard would be revised further. It is too ambiguous for the 
SEC or the PCAOB to state that their goal is to increase the “cost effectiveness of the 404 
audit” or “to eliminate lumecessary audit procedures” particularly when there has been no 
field testing of the new standard and therefore no assurance that it will reduce costs, 
Specific benchmarks or goals would convey to the industry that the SEC and the PCAOB 
is serious about reducing the overall costs of SOX 404 and is committed to achieving that 
goal. 

ICBA Continues to Have Doubts about the Cost Impact of AS-5 

In our statement to this Committee dated June 5, 2007^, ICBA commended the SEC and 
the PCAOB for their efforts to create a scalable, top-down approach for SOX 404 audits. 
As noted in the release for the SEC Guidance, the SEC Advisory Committee on Smaller 
Public Companies raised a number of concerns regarding the ability of smaller companies 
to comply cost-effectively with the requirements of SOX 404. Some of the concerns 
stemmed Ifom the implementation of Auditing Standard No. 2 and the fact that auditors 
were engaged in excessive testing of controls and requiring unnecessary documentation 
to comply with SOX 404. 

While the SEC Guidance and proposed AS-5 may curtail excessive testing of controls 
and reduce some of the unnecessary documentation required by SOX 404 audits, we still 
have doubts that it will reduce 404 audit costs, particularly for smaller public companies. 
We note, for instance, that AS5 has not been field tested so there is no evidence to 
suggest that, despite the proposed standard’s focus on scalability and risk-based testing, 
auditors will significantly change their audit procedures or reduce the time they take to 
perform a 404 audit. Furthermore, there has been nothing done to reduce the liability of 
auditors which we feel is just as important to reducing auditing costs as curtailing 
excessive control testing. 


^ See statement of ICBA in connection with the hearing by the House Small Business Committee (June 5, 
2007) on SOX 404 and whether the SEC’s and the PCAOB’s new standards would lower compliance costs 
for small companies. 
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ICBA Supports the Communities First Act and a SOX 404 Exemption for 
Community Banks 

ICBA supports the Community Banks Serving their Communities First Act of 2007 
(HR 1869) introduced by Chairwoman Velazquez which would relieve community 
banks with assets of less than $1 billion from the requirements of Section 404(b). 

The Communities First Act would make SOX 404 consistent with the FDIC 
Improvement Act of 1991 (FDICIA) and the corresponding banking regulations which 
exempt banks with less than $1 billion in assets from the internal control attestation 
requirements of that law. The banking regulators recently raised the small bank 
exemption under FDICIA to SI billion from $500 million in recognition of the fact that 
the industry is already highly regulated, that community banks pose less of risk to the 
Deposit Insurance Fund, and that internal control audits are very expensive for 
community banks. Whether it is the regulations under the Bank Secrecy Act, the USA 
Patriot Act, or SOX, community banks have so much regulation to contend with that 
more and more of them are considering merging or consolidating with larger entities. 

ICBA strongly endorsed the primary recommendations of the SEC’s Advisory 
Committee on Smaller Public Companies issued in 2005 including (a) exempting micro- 
cap companies (with equity capitalizations of $128 million or less) that have revenue of 
less than $125 million from the internal control attestation requirements of SOX Section 
404 and (b) exempting small-cap companies (with equity capitalizations of between $128 
million and $787 million) that have revenue of less than $250 million from the external 
audit requirements of SOX Section 404. Rusty Cloutier, ICBA’s former Chairman, 
represented the financial institutions industry on the Advisory Committee. We agree with 
the Advisory Committee that with more limited resources, fewer internal personnel and 
less revenue with which to offset the costs of Section 404 compliance, both micro-cap 
and small-cap companies have been disproportionately impacted by the burdens 
associated with Section 404 compliance. We also agree that the benefits of documenting, 
testing and certifying the adequacy of internal controls, while of obvious importance for 
large companies, are of less value for micro-cap and small-cap companies, that rely to a 
greater degree on “tone at the top” and high-level monitoring controls, to influence 
accurate financial reporting. 

The proportionately larger costs for smaller public companies to comply with Section 404 
adversely affect their ability to compete with larger public companies and even with 
foreign competition. This reduction in the competitiveness of U.S. smaller public 
companies hurts their capital formation ability and, as a result, hurts the U.S. economy. 
Even with a new internal control auditing standard, we believe that smaller public 
companies would still be subject to unnecessarily extensive auditing of detailed control 
processes under Section 404 by auditors unduly concerned about their liability and being 
second guessed by the PCAOB. 
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ICBA Also Strongly Supports Raising the Registration Threshold Under the 
Exchange Act 

ICBA also strongly supports raising the threshold for reporting companies under the 
Securities Exchange Act of 1934. Crurently, companies with $ 10 million in assets and 
500 shareholders are required to comply with that law. Although the asset size has been 
updated from $1 million to $10 million, the shareholder threshold has not been updated 
since the threshold was established in 1964. 

In addition to providing an exemption for community banks from Section 404(b), the 
ICBA-endorsed Communities First Act would raise the shareholder threshold under the 
Exchange Act to 1,000 from its present level of 500. This amendment to the Exchange 
Act would provide significant regulatory relief for hundreds of community banks like 
Pendleton Community Bank that are struggling with Exchange Act and SOX compliance. 

Conclusion 

ICBA believes that the new evidence from the Chamber’s SOX Survey should be a wake 
up call to the SEC concerning the excessive and disproportionate burden that community 
banks and other small companies are experiencing with SOX 404. Now that we have 
reached the end of 2007 and most non-accelerated filers have completed their 
management internal control reports, ICBA strongly supports Chairwoman Velazquez’s 
request to the SEC to delay the implementation of the auditor attestation requirements 
required by Section 404(b) which for calendar year filers, would begin in 2008. The one- 
year delay would give the SEC and the PCAOB an opportunity to assess the impact of 
AS-5 on internal control audits of accelerated and large accelerated filers and would 
enable small auditing firms that have yet to perform a Section 404 audit an additional 
year to analyze the PCAOB’s October 17* guidance to auditors in performing audits of 
smaller, less complex companies and participate in PCAOB-sponsored small-business 
auditing forums. 

ICBA believes that the SEC should conduct a comprehensive data collection program in 
connection with the implementation of SOX 404 for non-accelerated filers beginning this 
year and should establish benchmarks for AS-5. ICBA strongly supports the Community 
Banks Serving their Communities First Act of 2007 or HR 1869 introduced by 
Chairwoman Velazquez that would relieve community banks with assets of less than $1 
billion from the requirements of SOX Section 404(b) and would raise the shareholder 
threshold from 500 to 1 ,000 under the Exchange Act. 

ICBA appreciates this opportunity to testify before the House Small Business Committee 
concerning the impact that Section 404 of the Sarbanes-Oxley Act will have on small 
businesses and the new evidence from the Chamber’s Survey of Small Businesses. 
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Chairwoman Velazquez, Ranking Member Chabot and members of the 
Committee, thank you for the opportunity to testify today on behalf of AeA (the 
American Electronics Association) on Section 404 of the Sarbanes-Oxley Act and 
the burdens it continues to impose on smaller companies. We appreciate this 
committee’s efforts with regard to the effect that implementation of Section 404 is 
having on smaller companies and thank you for holding today’s hearing. 

My name is Tom Brandt, in addition to serving as the Chairman of AeA’s 
Sarbanes-Oxley Committee, I am the Chief Financial Officer of 
Telecommunication Systems, inc., orTCS, based in Annapolis, Maryland. 

AeA is the largest association of high-tech companies in the United States with 
about 2,500 companies, representing all segments of the industry and 1 .8 million 
employees. 

I have served as a corporate chief financial officer for more than 20 years. I spent 
the first nine years of my career working as a Price Waterhouse auditor, and in 
the mid-1990s, I returned to Price Waterhouse for three years, which gave me an 
updated giimpse of the profession from the inside. In addition to being a CPA, 
my education includes a degree in economics and management science from 
Duke University and an MBA from the Wharton Schooi of the University of 
Pennsylvania. 

My present company, TCS, was founded in 1987, and provides mission-critical 
wireless technology solutions to carriers, public safety, and government 
customers. Our patented technology enables text messaging, and premium 
carrier services that are based on knowing the location of wireless devices, 
including navigation, traffic data to cell phones, and E-91 1 call routing for first 
responder dispatch. For the Departments of Defense, State and Homeland 
Security, TCS sells secure satellite-based deployable communication systems, 
and related technical services. The company went public in 2000, and we 
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currently have about 500 employees and $120 million worth of stock trading on 
the NASDAQ. 

Section 404 Continues To Disproportionately Burden Small Public 
Companies 

My objective today is to illustrate the burden of Section 404 compliance on 
smaller public companies based on my direct experience, professional 
background, and insights from peer technology companies. Since TCS is not 
much larger than the cutoff between accelerated and non-accelerated filer, ours 
is a good case study of the disproportionate burden of Section 404 on smaller 
companies. When the new Section 404 rules became effective in 2004, we were 
just large enough to be an “accelerated filer,” so we are now completing our 
fourth year of Section 404 compliance. As inefficient as this regulatory impact 
has been on companies like mine, the adverse impact of imposing this burden on 
non-accelerated filers is alarming. 

Even with the modest changes since the law was first passed, the new 
compliance cost borne by investors in our companies is far greater than the 
benefit of any marginal accounting reassurance. We commend the Securities 
and Exchange Commission (SEC) and Public Company Accounting Oversight 
Board (PCAOB) for addressing this issue and attempting to improve 
implementation through the issuance of additional guidance for issuers and 
auditors; however, further relief for small public companies is needed. 

Regulators have suggested that the PCAOB’s new Auditing Standard Number 5 
(AS-5) should result in sufficient relief from excessive cost. My direct experience 
indicates that this is not true. The imminent application of Section 404 to non- 
accelerated filers will be disproportionately harmful to them, their investors, and 
their employees. As with any cost benefit judgment, there is a point of 
diminishing marginal returns where benefits are less than costs. The SEC’s 
Advisory Committee on Smaller Public Companies provided thoughtful cost 
benefit recommendations for stratified exemptions from costly 404 compliance 
processes, which AeA supports. The relief to date falls far short of those 
recommendations. 

Extension of Inefficiencies to “Non-Acceierated Filers Unnecessary 

In the absence of action by Congress or the SEC, sharp further increases in 
overhead costs are about to be incurred by nearly two thousand “non- 
accelerated filers,”^ that is, smaller public companies that have heretofore been 
exempt from Section 404 compliance. For small public companies, the bar of 
audit oversight and compliance is already high enough and expensive enough to 
reasonably protect investors from the risks of bad accounting, as evidenced by 


’ According to Hoover’s, there are nearly 1,900 public companies with a market capitalization of 
$75 million or less. Although this is not the only factor in determining non-accelerated filer status, 
it provides a reasonable estimate of how many companies will soon comply with Section 404 for 
the first time. 
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our seven-fold increase in recurring audit costs since we went public. All of the 
CEOs and CFOs will be obliged to sign the representations required by Section 
302. The objective of sustaining confidence in American capital markets is not 
reasonably affected - the aggregate market value of all public companies with a 
market capitalization of less than roughly $128 million represents only one 
percent of the securities traded on American exchanges.^ 

Having communicated directly with small cap investors for many years, I believe 
it is safe to assume that they factor the risk of a small company making an 
accounting error into their assignment of value to our shares. They are more 
concerned about our prudent use of cash and profitability. The assertion by 
some that pension plan investors need protection is fallacious: portfolios with low 
risk tolerance allow minimal investment in companies the size of the non- 
accelerated filers. 

I emphasize that my remarks are focused on the impact of this costly 
requirement on small public companies, which represent a very small part of the 
capital traded in the US public markets. Recall that the new Sarbanes-Oxley 
requirements were triggered by the very large and high-profile failures of 
WorldCom and Enron, and our government understandably took action to 
reassure the world that America’s capital markets are safe and strong. One 
proposition was that audits conducted by the CPA firms were insufficiently 
effective to detect the frauds or misstatements in those high-profile cases. To 
address this, the new law prescribed new annual audit reports, not on financial 
statements, but on processes. For many large companies, the proportion of 
incremental cost impact relative to overall profitability is negligible, and a case 
can be made that the accounting firms needed regulatory air cover to ensure 
higher fees - mainly so that they can pay the insurance premiums or build war 
chests to survive the legal claims that arise when something goes wrong. 

Telecommunication Systems: A Small Cap Case Study 

For companies like mine, however, the incremental compliance cost, relative to 
the amount of capital to which the public markets have given us access, is 
enormous. 

• In 1999, the last year before we went public and we were a $46 million 
company, our audit fees were about $50K. 

• In 2003, the last year before Section 404 went into effect and our revenue 
had grown to about $100 million, the fees to our Big Four CPA firm for 
their annual report on our accounts were $370K. This seven-fold increase 
in fees on a company that had only doubled in size mainly reflects the 
substantial extra work required to comply with public company reporting 
requirements, including quarterly reviews of financial reports. This cost 


^ This data was cited in the Final Report of the Advisory Cotnmittee on Smaller Public Companies 
(Apr. 23, 2006), See also SEC Office of Economic Analysis, Background Statistics: Market 
Capitalization and Revenue of Public Companies (Apr. 6, 2006). 
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reflects a lot of scrutiny for a small company - before layering on Section 
404. 

• In 2004, our audit fees more than doubled to $770K from the previous 
year. For 2005, when we were supposed to realize the benefits of a 
second-time-through cycle, our fees actually increased 13 percent to 
$871 K. In 2005, we also hired an internal auditor at an annual cost, with 
benefits, of about $130K. In 2006, we put the audit out for bids, inviting 
two non-Big Four firms and our incumbent to submit proposals. Our Big 
Four firm told us that because they were now able to rely on the work of 
our internal auditor, they were able to submit the lowest bid of about 
$621 K, which is still 67 percent higher than what we paid in 2003. 

• For 2007, the PCAOB’s AS-5 is effective for the first time. It is supposed 
to lower the costs for companies like mine, by allowing some reduced 
redundancy of documentation activity and allowing more reliance on the 
work of internal people. In addition, we were able to find alternatives that 
allow our auditors to rely on the “work of others,” as permitted under the 
new AS-5 guidance, with the expectation that by using other less costly 
internal and external sources the audit fees would decrease. Because of 
these developments, we asked for some reduction in our 2007 audit fees. 
My auditor told me that my company had already taken advantage of 
everything that AS-5 now allows, so I should expect our fees to remain 
unchanged. While the number of hours to do the work may have modestly 
declined, the average billing rates for auditors have risen sharply. 

As a former auditor, I am sympathetic that as “deep pockets,” the Big Four firms 
are compelled to charge more to cover their insurance and possible outlays for 
tort claims, as well as higher salaries to attract more people to do Sarbanes- 
Oxley work. But that burden should not be so disproportionately applied to small 
companies. 

Since 2003, our annual outside-auditor cost of compliance has doubled, that is, 
increased by more than 100 percent — but then declined by only a few 
percentage points. For additional perspective, the average overall pretax 
profitability of our business for 2005 through 2007 has been about $2 million a 
year. Annual outside audit fees of more than $600K represent a big bite out of 
our investors’ hides. The cost of the extra audit work on large securities issuers 
is proportionally inconsequential for most large companies. Fundamentally, 
however, there is a point below which the scope of audit work cannot be scaled 
down to be proportionate to the intended risk mitigation. 

I have shared this company-specific information because over the four-year 
period, the nature and scope of our company operations and financial statements 
has been sufficiently constant to make the numbers a fair example, and a 
harbinger of what lies ahead for non-accelerated filers. Based on discussions 
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with my peers, many other companies have been hit much harder. In addition, I 
have focused solely on the external auditor fees, ignoring the internal man-hours 
that are expended on writing narratives to document the processes or doing 
repetitive tests of key controls that are either drained away from more productive 
activities or funded by adding overhead staff such as internal auditors. Most 
small companies will be compelled to incur additional external costs to hire 
consultants to write the process documentation and perform the tests of the 
internal controls needed to support management’s certification and the auditor’s 
work. 

Benefits of “Internal Control” Audit Work Are Misunderstood 

Documentation of processes and testing of controls were part of audits when I 
started my career in 1973. Despite common misunderstandings, then and now, 
the scope of this work is not designed to catch the type of fraud seen at 
WorldCom and Enron. It is worth noting that, to date, nearly all of the financial 
statement errors detected as a result of Section 404 work have entailed 
application of tricky, technical rules relating to tax, leases, or stock option 
accounting, and rarely anything significant enough to change a reasonable 
investor's opinion as to the value of the company. 

While the SEC and the PCAOB have released new guidance in 2007 that 
encourages non-accelerated filers and their auditors to take an approach that is 
scaled to a smaller company, the key point here is that there is a point below 
which is it impossible to make the incremental costs proportionate to the benefits. 
These companies will still face additional costs related to the work needed to 
support management’s certification, as well as an increase in cost for the 
external auditors’ work to issue a separate opinion on internal control over 
financial reporting. It is not unreasonable to assume that non-accelerated filers 
will see the same multiples in increase in compliance and audit fees as those 
experienced by TCS. 

When I learned of today’s hearing, I wanted to testify because I am convinced 
that this is bad public policy. Access to capital through the issuance of publicly 
traded stock is a vital step in the growth of innovative, entrepreneurial 
businesses. For the people who are bold and successful enough to grow a 
company that is a candidate to go public, our small cap markets represent a 
valuable alternative to being forced to sell their companies or to slow growth and 
risk losing a competitive advantage. Some argue that companies too small to 
absorb Sarbanes-Oxley costs should not be allowed to issue publicly traded 
shares. I believe that entrepreneurs like my company’s founder should have 
fewer, not more, obstacles to grow a business and that investors are already 
sufficiently informed about the risks involved. When they can attract the support 
of public investors, they should have the freedom to pursue their visions rather 
than sell out. 
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Conclusion: The SEC, PCAOB and Congress Should Revisit the 
Recommendations of the Advisory Committee on Smaller Public 
Companies and Implement Reasonable, Stratified Exemptions 

It is hard to see any public policy benefit at all from the imposition of this 
incremental bureaucratic overhead on non-accelerated filers. Not only should 
these companies be permanently exempted, but Section 404 exemption relief 
should be expanded. The Advisory Committee on Smaller Public Companies’ 
recommendations should be re-visited. 
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TESTIMONY BEFORE THE HOUSE SMALL BUSINESS COMMITTEE 

“SARBANES-Oxley Section 404: New Evidence on the Costs for Small Businesses” 

Testimony by Shannon L. Greene, CPA 
Chief Financial Officer and Treasurer 
Tandy Leather Factory, Inc. 

December 12, 2007 


Good afternoon, Chairwoman Velazquez, Ranking Member Chabot, and members of the committee. 

My name is Shannon Greene and I am the Chief Financial Officer and Treasurer of Tandy Leather 
Factory, Inc. Our stock trades on the American Stock Exchange and we are a non-accelerated filer. Our 
market cap is currently $40 million. We are headquartered in Fort Worth, Texas and we have 100 retail 
and wholesale stores located across the United States and Canada. Our armual sales are approximately 
$55 million and we employee 450 people. 

Introduction 

The purpose of my being here today is to provide some perspective from a small business trying to 
maintain our position as a legitimate public company in today’s market. Thank you. Chairwoman and 
committee members, for holding this hearing and considering my remarks today. 

While I would prefer that we were discussing the potential elimination of Section 404 of the Sarbanes- 
Oxley Act, I acknowledge that such a discussion is irrelevant at this time. With that said, 1 applaud the 
SEC and the PCAOB for recognizing the need to provide scalable rules and guidance to smaller 
companies like ours as it pertains to Section 404. 

I would like to present several points for consideration: 

First, I believe that most small businesses support the concept of a strong internal control system. 

Second, non-accelerated filers who have not had to comply with Section 404 yet should not be the 
testing ground for the revised mles and guidance. 

Third, if a delay for non-accelerated filers is being considered, the decision to delay needs to be made 
now as many companies will be engaging their auditors soon for 404(b), if they haven’t done so already. 
Waiting until the summer to decide if there is going to be a delay could result in costs being incurred 
unnecessarily by companies between now and then. 

Fourth, the management teams of small business wear many hats as they generally do not have the 
financial resources for large staffs. The process required to comply with Section 404 further burdens a 
management that is already stretched thin. It is important that their process of compliance with Section 
404 be as efficient and cost effective as possible. Given the limited resources, dollars spent inefficiently 
on regulatory compliance could affect a small company’s ability to grow. 
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Fifth, it has been my experience that investor, whether individuals or institutions, are not as concerned 
with a company’s internal control system as tme might think. Many, if not all, of our investors would 
prefer continued growth in company profits rather than formal documentation and assessment of our 
internal control system. 

Background 

Tandy Leather Factory, Inc. has been in business since 1980. We went public through a reverse merger 
in 1993 and our stock currently trades on the American Stock Exchange. Since we became public, we 
have never restated our financial statements. In addition, to my knowledge, we have never recorded an 
adjustment to our financial statements as the result of our year-end audit. I would suggest that, while we 
may not have the best documented internal control system, the system appears to be working. 

We sell leather and leathercraft supplies through retail stores (“Tandy Leather”) and wholesale stores 
(“Leather Factory”). Our support and administrative departments are centralized in Fort Worth. Our 
Accounting/Finance Department consists of sixteen people as follows: 

Chief Accounting Officer 
Controller 
Payroll - 2 
Accounts Payable - 3 
Accounts Receivable - 3 
Daily Reports - 5 
Accounting Assistant 

The staff report to the Chief Accounting Officer who reports to the CFO. With the exception of the 
Chief Accounting Officer and Controller, the staff do not have any college education. We do not have 
an Internal Audit department. As the CFO, my professional background included a number of years in 
public accounting as an auditor so any internal audit function generally falls on my list of 
responsibilities. 

Tandy Leather Factory's Compliance Process Under the Old Section 404 Rules 

The original compliance schedule for Section 404 required a management assertion on internal controls 
for the year ended December 3 1 , 2004. The rules in place at that time required that our auditors provide 
an opinion on management’s assertion as of that date as well. Due to our size and the limited staff who 
truly understood the concept of intemal controls, we hired two outside consultants to help us develop the 
documentation of our intemal control system. 

Those consultants worked in our offices for six months - from July 2004 to February 2005. With their 
help, we put together fifteen to twenty three-ring binders and filled a four-drawer file cabinet with 
memos, checklists, supporting documents and other information as evidence of the intemal control 
system currently in place. Despite the enormous amount of work 1 felt we had done, our auditors, 
during a meeting with our audit committee in March 2006, indicated that the work we had done was 
“very basic and preliminary.” 

Our earnings in 2004 were $2.6 million. We spent $157,000 in fees to the two consultants. That 
represented almost 6% of our earnings that year. That amount doesn’t include the various billings from 
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our auditors to review “from a distance” the work we were doing and it certainly doesn’t include a dollar 
equivalent of the countless hours I spent working on the project. 

Small Businesses Shouldn’t Be the Testing Ground for the Revised Guidance 

I think we all agree that the 404 process as originally implemented was much more burdensome and 
costly to all companies than Congress intended. While the recent revisions appear to be headed in the 
right direction, no one will really know until companies start implementing those new rules. And we 
have already seen that a mere 168 words, as was the original Section 404, had far-reaching, unintended 
consequences and implications. It is important that we “get it right” this time and the best companies to 
make that assessment are those who have already gone through the process under the original rules. 

They have the prior experience and the staff to appropriately compare the old rules to the new ones. 
Small companies in their first year of compliance can not be expected to assess the improvement in the 
rules as they have no basis for comparison. 

The Section 404 process needs to be as streamlined as possible for small companies so that management 
teams can focus primarily on growing their business, creating new jobs and developing new products. It 
would be unfortunate to trade dollars spent on jobs or product development for inefficient regulatory 
compliance. The SEC and PCAOB have put forth strong efforts to ensure that companies and auditoi^ 
understand the new rules and guidance because the rule changes are not easy to understand. Companies 
as well as auditors are still “feeling their way along”. Small companies should not be the testing ground 
for the new rules given that Section 404 tends to have a disproportionate cost impact on smaller 
companies, with the first year being the most expensive. While I recognize that the revised regulations 
are an improvement from the original regulations, I would like to know that the revised regulations are 
going to work before we have to apply them to our small company. 

Timeliness of Decision to Delay for Smaller Companies 

It is important to emphasize that if a delay is being considered for non-accelerated filers, the decision 
needs to be made very soon. Our company’s year-end is December 3 1 404(b) applies to us for 2009. 

We don’t have the luxury of waiting until the summer or fall to engage our auditors. As a result, 
announcing a delay then will significantly minimize the benefit of that delay for a company like ours as 
we will have already incurred sizable costs in the form of additional audit fees during the first half of the 
year. 

Do Investors Care about Section 404 Compliance? 

We are considered a micro-cap in the world of public companies. Our market cap and trading volume is 
quite small, relatively speaking. Approximately 35% of our outstanding stock is owned by institutions 
some of which are so large, they could buy our entire company and not even realize it. I meet with a 
number of these institutions, as well as individual stockholders, either via telephone or in person 
numerous times a year. Many of our stockholders own our stock because they believe in the potential of 
our company and are comfortable that the management team knows how to grow the company and 
therefore increase its value. In all of my discussions with our stockholders and potential stockholders, I 
have yet to be asked about our internal control system and whether we are or expect to be in compliance 
with Sarbanes-Oxley Section 404. However, I am frequently asked how much we have and will spend 
trying to comply and how much of a negative impact it will have on our earnings. While most investors 
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want to invest in ethical companies, I’m not getting the impression that the internal control system is 
what helps those investors make that determination. A^in, it’s the people of the company. 

Due to the immense regulatory burden on public companies, large and small, I would suggest that we 
are discouraging companies fi-om participating in the public markets because it is not worth the effort. 
The objective of Section 404 of the Sarbanes-Oxley Act is to provide meaningful disclosure to investors 
about the effectiveness of a company’s internal control systems. Said a different way, investors should 
be able to rely on the information they are getting from a company. Rather than penalizing all 
companies with increased regulation, I think stiffer and swifter penalties for offenders is a more 
effective deterrent and would contribute more to the goal of a reputable public market. 

I am not minimizing the importance of regulatory compliance. While I do not always agree in principal 
with the rules and regulations set forth, I can assure you that my company takes this very seriously. We 
choose to operate our business within the rules, whether we agree with them or not. And we will 
comply with the rules of Section 404. I would just like to know that the cost to comply is money well 
spent. 

Conclusion 

Chairwoman Velazquez, Ranking Member Chabot, and members of the committee, I appreciate the 
opportunity to be here today and 1 hope you found my thoughts and opinions helpful. In summary, 
please consider my request to delay Section 404 compliance for small companies until it has been 
proven that the rules are achieving the intended results. Thank you for your time. 


Importers, Exporters, Manufacturers, Distributors, Retailers of Leathers, Leathercraft Supplies, Hardware, Findings and Finishes 



BIOTECHNOLOGY 

INDUSTRY ORGANIZATION 


THE STATEMENT OF THE 
BIOTECHNOLOGY INDUSTRY ORGANIZATION ON 

Sarbanes-Oxley Section 404: New Evidence on the Cost for Small Companies 
BEFORE THE HOUSE SMALL BUSINESS COMMITTEE 


Submitted 
December 12, 2007 


BIOTECHNOLOGY INDUSTRY ORGANZIATION 
1201 MARYLAND AVENUE, SW, SUITE 900 
WASHINGTON, D.C. 20024 
(202) 962-9200 
www.bio.or 2 





73 


The Biotechnology Industry Organization (BIO) appreciates the opportunity to provide the 
perspective of its members on the implementation of Section 404 of the Sarbanes-Oxley Act. 

BIO represents over 1,100 biotechnology companies, academic institutions, state biotechnology 
centers and related organizations in 50 U.S. states and 31 other nations. BIO members are 
involved in the research and development of health care, agricultural, industrial, and 
environmental biotechnology products. The majority of BIO member companies are small, 
research and development-oriented companies pursuing innovations that have the potential to 
improve human health, expand our food supply, and provide new sources of energy. The 
promise of biotechnology is immense, as our members combine biology and technology to 
deliver new treatments for immet medical needs, improved crops that are more drought resistant 
and have reduced environmental impact, and create cheaper, more environmentally friendly fuels 
and consumer products. Biotech is one of the most iiutovative high growth sectors of our 
nation’s economy, and one in which the United States maintains a global leadership position. 

In 2003, the Sarbanes-Oxley Act of 2002 (“SOX” or “Sarbanes-Oxley”) was signed into law 
providing a number of new requirements for financial reporting. While BIO members strongly 
support the Congressional intent behind SOX Section 404 — to enhance investor protection and 
confidence — the implementation of Section 404 has unfortunately caused problems for many 
emerging biotechnology companies, including confusion and substantially greater than expected 
compliance costs. 

For many emerging biotechnology companies, funds that would otherwise be spent for core 
research and development of new therapies for patients are instead used for overly complex 
controls or unnecessary evaluation of controls. Diversions of resources away from research 
activities can delay critical product development and have a detrimental effect on a company’s 
ability to raise capital. For most biotechnology companies, the actual costs of Section 404 
compliance, including both internal costs as well as external auditor costs, are substantial. In fact, 
the opportunity costs of Section 404 for smaller companies can be even greater, impeding the 
ability to invest in and continue ongoing, critical research and development activities for 
treatments of an array of diseases, from cancer to multiple sclerosis. 

The current problems faced by emerging biotechnology companies are not merely growing pains 
in which costs and burdens decrease as auditors and companies become more familiar with the 
process and requirements of Section 404. Rather, costs and burdens are fixed and ongoing, 
impacting the long-term investment resources of all microcap and smallcap companies including 
those on the forefront of developing new treatments for many diseases. Much of the 
implementation costs of Section 404 are a result of the SEC and PCAOB imposing the same 
requirements, steps and reviews on all companies, regardless of size. As a result, costs are 
disproportionately burdensome for emerging biotechnology companies that often have little or 
no product revenue to devote to additional compliance costs. Therefore, this shifts shareholder 
equity from core research functions to outside auditors. 

SEC and PCAOB’s New Standards 


BIO commends both the Securities and Exchange Commission (SEC) and the Public Company 
Accounting Oversight Board (PCAOB) for taking steps to address some of the compliance 
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problems that Section 404 audits had been creating for public companies. However, BIO 
remains concerned that the agencies’ guidance, particularly to auditors, with respect to smaller 
public companies, may not live up to the high expectations the SEC and PCAOB have placed 
upon the new rules and guidance. 

In My 2007, the SEC approved the PCAOB’s Auditing Standard Number 5 (AS-5) to replace 
the old AS-2 standard in an attempt to mitigate the implementation costs of Section 404. Despite 
the previous recommendations of the SEC’s Advisory Committee on Smaller Public Companies, 
as well as comments from a variety of industry groups including BIO, the SEC approved AS-5 
without revisions necessary to ensure that smaller public companies will have the benefit of 
scaled audits. While BIO applauds the intent of AS-5, it does not appropriately give smaller 
companies the intended relief that will reduce compliance costs while maintaining the core 
principles of SOX. 

Definition of Smaller Public Company 

In removing all objective definitions of “smaller company” in AS-5 guidance, the SEC and 
PCAOB have failed to give smaller public companies any deference to be deserving of a scaled 
audit but rather have empowered auditors to continue to look at all companies the same, 
regardless of size. As recommended by the SEC’s own Advisory Committee on Smaller Public 
Companies, a “smaller company” would include 

“companies with a market capitalization of approximately $700 million or less, with 
reported annual revenue of approximately $250 million or less.” 

Removal of any reference to market capitalization or annual revenues deleted the only objective 
criteria for scalability. As a result, the final determination of “size and complexity of a company 
in planning and performing the audit” lies heavily on the shoulders of the auditor, thereby 
creating unfortunate conflicts of interest. First, auditors have an economic incentive to maximize 
profits by determining a company, independent of its size, as complex and therefore requiring a 
more extensive audit. Second, auditors currently face unlimited exposure to legal liability. This 
exposure understandably places their incentives in line with an overly ambitious audit of internal 
controls. Third, due to a lack of any penalties for being overly aggressive and creating 
unnecessary costs in an audit, there is no incentive for an auditor to be looking for ways to scale 
the audit. 

To its credit, the PCAOB nevertheless continues to discuss smaller public company issues 
throughout the rule — at least thirteen times by our count. Yet it is a startling failure on PCAOB’s 
part that it chose to no longer provide any definition of smaller company, while maintaining the 
subjective definition of less complex companies. 

BIO and our member companies believe that an objective definition of “smaller company” is the 
best way to mitigate against the current auditor incentives toward unnecessarily burdensome and 
costly audits. 
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Product Revenue 

BIO consistently advocates for scalability indicia that are most reflective of complexity. BIO 
supports the PCAOB’s work to include the scalability criteria and guidance throughout the 
auditing standard. In order to achieve the benefits of the scalable approach, it is imperative that 
the auditors be encouraged to apply the criteria throughout the audit. In doing so, they minimize 
the combined threat of litigation and PCAOB examination based upon terms and definitions that 
are mandatory and inflexible, and discourages auditors from using the maximum degree of 
checklist compliance. 

BIO believes that product revenue is the best indicator of complexity which could be used in 
conjunction with various attributes of smaller companies, such as market capitalization and 
overall revenue, and independently as proxies for complexity. 

The SEC Advisory Committee Final Report on Smaller Public Companies also recommended 
that a “revenue filter” be used as a tool to define a smaller public company when scaling an 
audit. However, the SEC and PCAOB chose not to include this objective criteria in its final AS- 
5 guidance. 

Rather than limiting auditor judgment by linking various attributes of smaller companies such as 
market capitalization and overall revenue, the SEC and PCAOB should be looking for ways to 
provide the indicia to auditors that operate both in conjunction with and independently as proxies 
for complexity. 

Economic Cost-Benefit Studies 

Lastly, BIO strongly believes that a rigorous economic study of the costs and benefits associated 
with implementation of Section 404 is imperative to understanding if the current reform 
proposals are meeting their objectives. Specifically, the SEC Office of Economic Analysis 
should be required to provide a quantitative annual cost estimate of the costs of complying with 
Section 404, for all companies, but specifically broken down between large companies and 
"smaller companies" using the definition of the SEC Advisory Committee. These studies should 
be used annually in reassessing the usefulness and necessity for an audit of internal controls. 

Conclusion 


BIO appreciates the efforts that both agencies have taken to improve SOX implementation. It is 
unclear, however, whether these reforms will frilly match the rhetoric surrounding their adoption. 
BIO remains hopeful that this is just the first of several steps both the PCAOB and the SEC will 
take in reducing the unnecessary burdens of Sarbanes-Oxley on America’s emerging and 
innovative companies. Consistent oversight into the application of these new rules and 
consequent appreciation of how they are continuing to impact capital formation particularly for 
small companies will be critical to restoring the U.S, to its proper primacy in the global capital 
markets. 
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“SARBANES-OXLEY SECTION 404: NEW EVIDENCE ON THE COST FOR 
SMALL COMPANIES” 

DECEMBER 12, 2007 

The AFL-CIO strongly supported the enactment of the Sarbanes-Oxley Act of 2002, 
including Section 404, the internal control section. As a practical matter, capital markets 
thrive when investors have confidence in them. As a principled matter, no company 
should be able to sell securities “ whether to workers’ benefit funds or to individual 
investors - without having in place the necessary interna! controls to ensure that the 
company’s financial disclosures are accurate. 

The House Small Business Committee is convening a hearing today to discuss a survey 
conducted by the U. S. Chamber of Commerce asserting that small businesses are overly 
burdened by Sarbanes-Oxley Section 404(b) (“SOX 404(b)”). This survey is presented as 
evidence to support a delay in the implementation of SOX 404(b). The study imder 
discussion today, entitled “Cost of SOX 404 Survey,” suffers from severe methodological 
shortcomings, rendering the results invalid. As a result, calls for the delay of the 
implementation of SOX 404(b) based on the Chamber’s study are without merit. 

The Chamber asked almost 5,000 businesses that might be affected by SOX 404(b) to 
complete a simple on-line survey asking questions that encouraged the answers the 
Chamber wanted. Of the 4,984 businesses surveyed, only 177 businesses responded. 

The Chamber study has an obvious self-selection problem. The only reliable finding it 
contains is that only 3.6% of the survey population thought the issue of significant 
importance to reply. Policy recommendations cannot responsibly be based on a single 
survey lacking any methodological credibility. 

The Sarbanes-Oxley Act states that all publicly traded firms must comply with Section 
404. The SEC has extended, four times, the compliance deadline for smaller companies 
with Section 404. Small companies have had five years to prepare, and smaller firms and 
their auditors have had the benefit of several years’ experience (2003-2007) of large 
companies’ compliance with internal controls and audits. The AFL-CIO urges the 
Committee to allow the Securities and Exchange Commission to carry out its plan for the 
Sarbanes-Oxley Act to take full effect without any further delay or interference. 
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